GCGA Ch. 6 Recognizing Common Attacks (ST)

Question 1

Social engineering

Answer 1

uses social tactics to gain information or trick users into performing actions they wouldn’t normally take. Social engineering attacks can occur in person, over the phone, while surfing the Internet, and via email. Many social engineers attempt to impersonate others.Social engineers and other criminals employ several psychology-based principles to help increase the effectiveness of their attacks. They are authority, intimidation, consensus, scarcity, urgency, familiarity, and trust.

Question 2

Shoulder surfing

Answer 2

an attempt to gain unauthorized information through casual observation, such as looking over someone’s shoulder, or monitoring screens with a camera. Screen filters can thwart shoulder surfing attempts. Social engineers use pretexting by presenting a fake scenario before asking for information.

Question 3

Hoax

Answer 3

a message, often circulated through email, that tells of impending doom from a virus or other security threat that simply doesn’t exist.

Question 4

Tailgating

Answer 4

the practice of one person following closely behind another without showing credentials. Access control vestibules (sometimes called mantraps) help prevent tailgating.

Question 5

Dumpster divers

Answer 5

search through trash looking for information. Shredding or burning documents reduces the risks associated with dumpster diving.

Question 6

Watering hole attacks

Answer 6

discover sites that a targeted group visits and trusts. Attackers then modify these sites to download malware. When the targeted group visits the modified site, they are more likely to download and install infected files.

Question 7

Spam

Answer 7

unwanted or unsolicited email. Attackers often use spam in different types of attacks.

Question 8

Phishing

Answer 8

the practice of sending email to users to trick them into revealing sensitive information, installing malware, or clicking on a link.

Question 9

Spear phishing and whaling

Answer 9

types of phishing. Spear phishing targets specific groups of users, and whaling targets high-level executives.

Question 10

Vishing

Answer 10

a form of phishing that uses voice over the telephone and often uses Voice over IP (VoIP). Some vishing attacks start with a recorded voice and then switch over to a live person.