1.1

Question 1

Is a type of cyber attack where attackers attempt to trick individuals into disclosing sensitive information. The attackers typically disguise themselves as trustworthy entities, using deceptive emails, messages, or websites to manipulate users into taking actions that they otherwise wouldn’t.

Answer 1

Phishing

Question 2

What is this list examples of?
1. Be Skeptical of Unsolicited communications
2. Check email sender information
3. Avoid clicking on suspicious links.
4. Verify Requests for Personal Information
5. If a website, check the URL. Additionally, there’s usually something not quite right on the website. (Spelling, fonts, graphics)

Answer 2

Ways to avoid Phishing

Question 3

How is phishing so successful?

Answer 3

Phishing is so successful because it is digital slight of hand.

Question 4

Is a type of Phishing that is done through text. (SMS Phishing)

Answer 4

Smishing

Question 5

Is a type of Phishing that is done over the phone or voicemail. (Voice Phishing)

Answer 5

Vishing

Question 6

Are unsolicited, irrelevant, or inappropriate messages sent over the internet. These messages are typically sent in large volumes to users, and they can take various forms, such as emails, instant messages, comments on websites, or social media posts.

Answer 6

Spam

Question 7

Is a variation of SPAM that is delivered via instant messaging

Answer 7

Spam Over Instant Messaging (SPIM)

Question 8

Is phishing that targets a specific person or group of people. Is targeted phishing with inside information. Makes the attack more believable.

Answer 8

Spear Phishing

Question 9

Is the act of searching through garbage for personal information.

Answer 9

Dumpster Diving

Question 10

Is the practice of spying on someone’s computer screen or mobile device screen to obtain sensitive information.

Answer 10

Shoulder Surfing

Question 11

Is a cyber attack technique where attackers redirect the traffic of a legitimate website to a fraudulent or malicious website without the users’ knowledge. The goal of this attack is to collect sensitive information such as usernames, passwords, or financial details from unsuspecting users.

Answer 11

Pharming

Question 12

When an unauthorized person uses an authorized person to gain access to a building.

Answer 12

Tailgating

Question 13

The act of coercing information from the victim using social engineering and psychological techniques. For example, calls to and from a Help Desk can be used to go about _____________ .

Answer 13

Eliciting Information

Question 14

Targeted phishing with the possibility of a large catch. High-value targets are referred to as ‘Whales’, such as a CEO or CFO.

Answer 14

Whaling

Question 15

The act of adding something else to the beginning of an item. When used in a social engineering context, it is the act of supplying information to legitimize a request. Ex: An attacker can use ____________ by stating they were sent by the target’s boss, as a means to justify why the target should perform a specific action.

Answer 15

Prepending

Question 16

Is the use of fake credentials to achieve an end. An example, is pretending to be an official representative of a government agency.

Answer 16

Identity Fraud

Question 17

This type of scam uses a fake invoice in an attempt to get a company to pay for things it has not ordered. The ‘From: Address’ could be a spoofed version of the CEO’s. Involves a bit of spear phishing because the attacker knows who pays the bills.

Answer 17

Invoice Scams

Question 18

Involves the collection of login credentials. There are many stored credentials on your computer. (stored on Chrome, Firefox, Outlook, Windows Credential Manager, etc.) Can start from a phishing email that contains a malicious Microsoft Word doc. Opening the document runs a macro. The macro downloads credential-harvesting malware and the user would have no idea.

Answer 18

Credential Harvesting

Question 19

As an attacker, is the act of gathering information on a victim. Background information of a victim can be found through lead generation sites, social media, their corporate website, etc.

Answer 19

Reconnaissance

Question 20

Is a deceptive or misleading message or piece of information that circulates widely. Are designed to trick users into believing false claims or taking certain actions that may be harmful or disruptive.

Answer 20

Hoax

Question 21

When an attacker assumes a role that is recognized by the person being targeted. The attacker uses the victim’s biases against them.

Answer 21

Impersonation

Question 22

Is a type of attack in which attackers compromise a website or online resource that is frequently visited by a specific target group. The attackers inject malicious code into the website or use other means to exploit vulnerabilities, with the goal of infecting the computers of individuals who visit the site.

Answer 22

Watering Hole Attack

Question 23

Is an attack form that involves capitalizing upon common typographical errors. When there’s a slight change in spelling of a URL. Is designed to direct users to a malicious webpage.
Ex: Real URL - https://professormesser.com
Fake URL - https://professormessor.com

Answer 23

Typosquatting

Question 24

is a social engineering technique used by attackers to manipulate individuals into divulging sensitive information or performing certain actions. The attacker uses a pre-established fabricated scenario, often impersonating someone trustworthy, to deceive the target and gain access to confidential information.

Answer 24

Pretexting

Question 25

Are coordinated efforts by individuals, groups, or nation-states to manipulate information, shape public opinion, or influence decision-making processes through various digital means. These campaigns often leverage social media to spread disinformation, sow discord, or achieve specific political, social, or economic objectives.

Answer 25

Influence Campaigns

Question 26

Refers to a military strategy that combines conventional warfare, irregular warfare, and cyber warfare to achieve strategic objectives. In the context of cybersecurity, ____________ involves the integration of cyber operations with traditional military and non-military tactics to create a comprehensive and multifaceted approach to conflict. This approach blurs the lines between physical and virtual domains.

Answer 26

Hybrid Warfare

Question 27

1. Authority
   a. The social engineer is in charge.
   Ex: “I’m calling from the office of the CEO. “
2. Intimidation
   a. “You will be reprimanded if you don’t help.”
3. Consensus/Social Proof
   a. Convince based on what’s normally expected.
   b. “Your coworker Jill did this for me last week.”
4. Scarcity
   a. “The situation will not be this way for long. We must
   make the change before time expires.”
5. Familiarity
   a. Someone you know.
   b. May have common friends.
6. Trust
   a. Someone who is safe.
   b. “I’m from IT, and I’m here to help.”
7. Urgency
   a. Works alongside scarcity.
   b. Act quickly, don’t think.

Answer 27

Principles (Reasons for Effectiveness) of Social Engineering