Social Engineering & Human Factor Security Flashcards

What is 'baiting' as a social engineering technique?

Answer: Leaving infected USB drives or media in public places for victims to find

Baiting lures victims by leaving malware-laden physical media (like USB drives) where curious individuals will pick them up and insert them into computers.

Which term describes a highly targeted phishing attack aimed at a specific individual or organization?

Answer: Spear phishing

Spear phishing targets specific individuals using personalized information to make the attack more convincing than generic phishing campaigns.

What is 'whaling' in the context of social engineering?

Answer: Spear phishing attacks targeting senior executives or high-profile individuals

Whaling targets 'big fish' such as CEOs, CFOs, and other executives, leveraging their authority and access to high-value systems.

What countermeasure best protects against phishing attacks in an organization?

Answer: Implementing multi-factor authentication and employee phishing simulations

Combining MFA (to limit damage if credentials are stolen) with simulated phishing training significantly reduces organizational phishing risk.

What does 'quid pro quo' mean as a social engineering tactic?

Answer: Offering a service or benefit in exchange for information or access

In quid pro quo attacks, the attacker offers something valuable (like IT help) in exchange for the victim providing credentials or access.

Which behavior is the best indicator that an employee has been effectively trained against social engineering?

Answer: They verify unexpected requests through an out-of-band communication channel

Verifying requests via a separate, trusted channel (like calling the requester directly on a known number) defeats most social engineering attempts.