Social Engineering
o In person, over phone, while browsing, via email
o Take advantage of normal social behaviors & trust
o Sending emails with purpose to trick them into revealing personal information / performing acts
o DOES NOT target specific group
targets specific groups of users
—Attacks can be customized [more dangerous]
o Whaling
targets high-level executives
o Vishing
voice phishing
–Verify identity & contact info of caller
–Caller-ID can be spoofed
o Smishing
-Uses SMS Texts
-Instant messages / social media
–Person looks through trash for info
–Burning / shredding helps prevent
Looking over shoulder with camera to view sensitive information
Follow closely behind someone to enter a secure area
Pretend to be someone else
Usually impersonate tech support / company personal
Fraudulent WiFi access point that appears to be legit
Setup to eavesdrop on wireless communication