1
00:00:00,450 --> 00:00:01,950
In this section of the course,

2
00:00:01,950 --> 00:00:03,690
we're going to discuss social engineering.

3
00:00:03,690 --> 00:00:06,270
So, what exactly is social engineering?

4
00:00:06,270 --> 00:00:09,300
Well, social engineering is a manipulative strategy

5
00:00:09,300 --> 00:00:11,010
that exploits human psychology

6
00:00:11,010 --> 00:00:14,010
to gain unauthorized access to systems, data,

7
00:00:14,010 --> 00:00:15,960
or physical spaces.

8
00:00:15,960 --> 00:00:18,330
Social engineering includes written communication

9
00:00:18,330 --> 00:00:20,190
as well as face-to-face interaction.

10
00:00:20,190 --> 00:00:22,980
Instead of just using technical hacking techniques,

11
00:00:22,980 --> 00:00:24,750
social engineers manipulate people,

12
00:00:24,750 --> 00:00:26,700
revealing confidential information

13
00:00:26,700 --> 00:00:30,090
or performing actions that compromise security.

14
00:00:30,090 --> 00:00:33,060
Techniques can range from phishing emails and pretexting,

15
00:00:33,060 --> 00:00:35,010
where attackers create a false scenario

16
00:00:35,010 --> 00:00:36,360
to obtain information,

17
00:00:36,360 --> 00:00:39,390
to baiting and tailgating, where physical access is gained

18
00:00:39,390 --> 00:00:42,930
through deception or exploiting human courtesy.

19
00:00:42,930 --> 00:00:45,420
As the attacks target the human element,

20
00:00:45,420 --> 00:00:47,580
the best defense against social engineering

21
00:00:47,580 --> 00:00:50,730
is to provide security awareness training to your users.

22
00:00:50,730 --> 00:00:52,260
This kind of regular training

23
00:00:52,260 --> 00:00:54,420
on how to best recognize and respond

24
00:00:54,420 --> 00:00:55,650
to social engineering attacks

25
00:00:55,650 --> 00:00:57,240
is crucial in maintaining the security

26
00:00:57,240 --> 00:01:00,300
of both your digital and physical environment.

27
00:01:00,300 --> 00:01:01,980
For this section on social engineering,

28
00:01:01,980 --> 00:01:03,630
we're going to be covering some objectives

29
00:01:03,630 --> 00:01:05,850
in Domain 2 and Domain 5,

30
00:01:05,850 --> 00:01:07,650
specifically Objectives 2.2 and 5.6.

31
00:01:09,720 --> 00:01:11,970
Objective 2.2 states that you must be able

32
00:01:11,970 --> 00:01:15,330
to "explain common threat vectors and attack services."

33
00:01:15,330 --> 00:01:16,560
Now, in this objective,

34
00:01:16,560 --> 00:01:18,960
we're going to be really focusing on the social engineering

35
00:01:18,960 --> 00:01:20,940
or human-based attack vectors,

36
00:01:20,940 --> 00:01:23,100
like phishing, vishing, smishing,

37
00:01:23,100 --> 00:01:25,230
misinformation and disinformation,

38
00:01:25,230 --> 00:01:27,720
impersonation, business email compromise,

39
00:01:27,720 --> 00:01:30,840
pretexting, water-holing, brand impersonation,

40
00:01:30,840 --> 00:01:31,990
and also typosquatting.

41
00:01:32,850 --> 00:01:34,507
For Objective 5.6, it states,

42
00:01:34,507 --> 00:01:35,610
"Given a scenario,

43
00:01:35,610 --> 00:01:38,910
you must be able to implement security awareness practices,"

44
00:01:38,910 --> 00:01:41,580
such as conducting anti-phishing campaigns and training,

45
00:01:41,580 --> 00:01:42,810
and things like that.

46
00:01:42,810 --> 00:01:44,670
Now, as we kick off this section,

47
00:01:44,670 --> 00:01:45,720
we're going to first discuss

48
00:01:45,720 --> 00:01:47,400
the different motivational triggers

49
00:01:47,400 --> 00:01:48,690
used by social engineers,

50
00:01:48,690 --> 00:01:51,300
like familiarity, likability,

51
00:01:51,300 --> 00:01:54,300
consensus and social proof, authority and intimidation,

52
00:01:54,300 --> 00:01:56,700
and also scarcity and urgency.

53
00:01:56,700 --> 00:01:59,130
Then we will discuss impersonation.

54
00:01:59,130 --> 00:02:01,290
Now, impersonation simply means

55
00:02:01,290 --> 00:02:02,790
pretending to be someone else,

56
00:02:02,790 --> 00:02:04,770
and that is one of the most basic forms

57
00:02:04,770 --> 00:02:06,780
of social engineering techniques used by attackers

58
00:02:06,780 --> 00:02:08,039
when they're trying to conduct

59
00:02:08,039 --> 00:02:09,840
a general impersonation attack,

60
00:02:09,840 --> 00:02:12,000
brand impersonation, typosquatting,

61
00:02:12,000 --> 00:02:14,520
and waterhole-based attacks.

62
00:02:14,520 --> 00:02:16,410
Next, we have pretexting.

63
00:02:16,410 --> 00:02:18,330
Pretexting is a form of social engineering

64
00:02:18,330 --> 00:02:20,700
where attackers create a convincing pretext

65
00:02:20,700 --> 00:02:22,290
or fabricated scenario

66
00:02:22,290 --> 00:02:23,790
to manipulate their targets

67
00:02:23,790 --> 00:02:25,920
into divulging sensitive information

68
00:02:25,920 --> 00:02:29,190
or perform actions that compromise security.

69
00:02:29,190 --> 00:02:30,840
The attacker often impersonates

70
00:02:30,840 --> 00:02:32,940
a trusted individual or an authority figure,

71
00:02:32,940 --> 00:02:35,550
such as a bank official, IT support,

72
00:02:35,550 --> 00:02:38,490
or law enforcement officer to gain trust

73
00:02:38,490 --> 00:02:40,140
and get them to divulge confidential

74
00:02:40,140 --> 00:02:43,110
or sensitive data to the attacker.

75
00:02:43,110 --> 00:02:45,180
After that, we're going to take a deep dive

76
00:02:45,180 --> 00:02:47,100
into the different types of phishing attacks

77
00:02:47,100 --> 00:02:48,210
used by social engineers,

78
00:02:48,210 --> 00:02:50,523
including phishing, vishing, smishing,

79
00:02:51,990 --> 00:02:53,700
spear phishing, whaling,

80
00:02:53,700 --> 00:02:56,700
and business email compromise-based attacks.

81
00:02:56,700 --> 00:02:57,720
Next, we will look

82
00:02:57,720 --> 00:02:59,970
at how you can best prevent phishing attacks

83
00:02:59,970 --> 00:03:01,650
and enhance the security awareness

84
00:03:01,650 --> 00:03:03,180
of your organization's employees

85
00:03:03,180 --> 00:03:05,550
by conducting end user training.

86
00:03:05,550 --> 00:03:08,190
Then we will cover fraud and scams.

87
00:03:08,190 --> 00:03:11,400
Frauds and scams are deceptive practices or schemes

88
00:03:11,400 --> 00:03:12,780
designed to deceive people

89
00:03:12,780 --> 00:03:15,810
into parting with their money or valuable information.

90
00:03:15,810 --> 00:03:18,510
So, we are going to provide you some great ways

91
00:03:18,510 --> 00:03:21,150
to effectively identify these frauds and scams,

92
00:03:21,150 --> 00:03:23,190
as well as how you can train your users

93
00:03:23,190 --> 00:03:25,770
to be vigilant against these type of attacks.

94
00:03:25,770 --> 00:03:28,680
After that, we'll cover influence campaigns.

95
00:03:28,680 --> 00:03:31,230
Influence campaigns are a form of social engineering

96
00:03:31,230 --> 00:03:32,370
and psychological attack

97
00:03:32,370 --> 00:03:35,160
that is used to spread misinformation and disinformation

98
00:03:35,160 --> 00:03:38,820
that can potentially have an effect on politics, economics,

99
00:03:38,820 --> 00:03:40,740
and other key areas of our lives.

100
00:03:40,740 --> 00:03:42,030
Next, we'll cover some

101
00:03:42,030 --> 00:03:44,280
of the other various social engineering attacks out there,

102
00:03:44,280 --> 00:03:47,820
such as diversion theft, hoaxes, shoulder surfing,

103
00:03:47,820 --> 00:03:50,610
dumpster diving, eavesdropping, baiting,

104
00:03:50,610 --> 00:03:51,960
piggybacking, and tailgating,

105
00:03:51,960 --> 00:03:53,370
just to make sure you're well prepared

106
00:03:53,370 --> 00:03:55,410
to encounter any of those attack vectors.

107
00:03:55,410 --> 00:03:57,510
And finally, we will take a short quiz

108
00:03:57,510 --> 00:03:58,680
just to see what you've learned

109
00:03:58,680 --> 00:03:59,970
during this section of the course,

110
00:03:59,970 --> 00:04:01,620
and review each of those quiz questions

111
00:04:01,620 --> 00:04:03,300
to fully ensure that you can explain

112
00:04:03,300 --> 00:04:05,040
why the right answer was right.

113
00:04:05,040 --> 00:04:06,210
So, let's get started

114
00:04:06,210 --> 00:04:07,830
with our coverage of social engineering

115
00:04:07,830 --> 00:04:09,393
in this section of the course.