Social Engineering

Question 1

The social engineer (attacker) focuses on 4 things …

Answer 1

• Goal
• Receiver
• Message
• Channel

Question 2

Name 4 ways to mitigate social engineering

Answer 2

Any four from:

• Education
• Increase awareness of information being released
• Identify valuable assets
• Policy & Awareness
• Keep software up to date
• Make all employees equal partners
• Implement need-to know information dissemination
• Be suspicious
• Not punishing when employees do not give out information.

Question 3

Name 3 Common types of Social Engineering attacks:

Answer 3

• Phishing
• In-Person
• Baiting - Leaving USBs lying around
• Piggybacking
• Physical Security

Question 4

Goal - What does the social engineer want to achieve?

Give 2.

Answer 4

Getting information
Gaining Access
Malware
Getting someone to perform an action

Question 5

How may an attacker Build Rapport?

Give 2.

Answer 5

• Draw the person out (can be done simply by talking to the person)

Building Rapport

• People tend to be polite
• People like to appear intelligent
• If you are praised you talk more
• Most people only lie when they have a motivation to lie
• People respond when others appear to care about them