CYS405 · Chapter 9 · Annotated SlidesSocial Engineering
Original
Overview

Social Engineering

What social engineering is and why it works, common targets and vulnerable behaviours, attack phases, human-, computer- and mobile-based techniques (impersonation, vishing, eavesdropping, phishing…), insider threats, countermeasures and social-engineering pen tests.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 47 slides
  1. 1 Slide 1
  2. 2 Slide 2
  3. 3 What is Social Engineering?
  4. 4 ▪ After information gathering, an attacker executes social engineering
  5. 5 Slide 5
  6. 6 Slide 6
  7. 7 Common Targets of Social Engineering
  8. 8  System Administrators: A system administrator in an organization is
  9. 9 Impact of Social Engineering Attack on Organization
  10. 10  Dangers of Terrorism: Terrorism and anti-social elements
  11. 11 Behaviors Vulnerable to Attacks
  12. 12 Behaviors Vulnerable to Attacks
  13. 13 Factors that Make Companies Vulnerable to Attacks
  14. 14  Several Organizational Units Some organizations have their units at
  15. 15 Why is Social Engineering Effective?
  16. 16 Phases of a Social Engineering Attack
  17. 17 Types of Social Engineering
  18. 18 An attacker can perform human-based social engineering by using the following techniques: • Impersonating
  19. 19 Impersonation
  20. 20 Impersonation (Vishing)
  21. 21 Human-based Social Engineering: Eavesdropping, Shoulder Surfing and Dumpster Diving
  22. 22 Human-based Social Engineering: Reverse Social Engineering, Piggybacking, and Tailgating
  23. 23 ▪ Computer-based Social Engineering
  24. 24 Computer-based Social Engineering
  25. 25 Slide 25
  26. 26 Computer-based Social Engineering: Phishing
  27. 27 ▪ Mobile-Based Social Engineering
  28. 28 Mobile-based Social Engineering: Publishing Malicious Apps and Repackaging Legitimate App
  29. 29 Mobile-based Social Engineering: Fake Security Applications
  30. 30 Mobile-based Social Engineering: SMiShing (SMS Phishing
  31. 31 Insider Threat / Insider Attack
  32. 32  Terminated Employees : Some employees take valuable information about the company with them when terminated. These employees access company s data even after termination using backdoors, malware, or their old ’ credentials because they are not disabled.
  33. 33 Companies where insider attacks are common include credit card companies, health-care companies, network service providers, as well as financial and exchange service providers.
  34. 34  Become Future Competitor Current employees may plan to
  35. 35 Countermeasures
  36. 36 Social Engineering Countermeasures
  37. 37 Social Engineering Countermeasures (Cont’d)
  38. 38 Insider Threats Countermeasure
  39. 39 How to Detect Phishing Emails
  40. 40 Anti-Phishing Toolbar
  41. 41 Social Engineering Pen Testing
  42. 42 Social Engineering Pen Testing (Cont’d)
  43. 43 Social Engineering Pen Testing: Using Phone
  44. 44 Social Engineering Pen Testing: In Person
  45. 45 Social Engineering Penetration Testing Tool
  46. 46 Know What the Web Knows About You
  47. 47 Summary
Slide 1 / 47

Slide 1

Slide 1: Slide 1
Slide 2 / 47

Slide 2

Slide 2: Slide 2
Slide 3 / 47

What is Social Engineering?

Slide 3: What is Social Engineering?

Notes

  1. Social engineering: manipulating people into revealing information or performing actions. Exploits trust, not technology.

Slide 4 / 47

▪ After information gathering, an attacker executes social engineering

Slide 4: ▪ After information gathering, an attacker executes social engineering
Slide 5 / 47

Slide 5

Slide 5: Slide 5
Slide 6 / 47

Slide 6

Slide 6: Slide 6
Slide 7 / 47

Common Targets of Social Engineering

Slide 7: Common Targets of Social Engineering
Slide 8 / 47

 System Administrators: A system administrator in an organization is

Slide 8:  System Administrators: A system administrator in an organization is
Slide 9 / 47

Impact of Social Engineering Attack on Organization

Slide 9: Impact of Social Engineering Attack on Organization
Slide 10 / 47

 Dangers of Terrorism: Terrorism and anti-social elements

Slide 10:  Dangers of Terrorism: Terrorism and anti-social elements
Slide 11 / 47

Behaviors Vulnerable to Attacks

Slide 11: Behaviors Vulnerable to Attacks

Notes

  1. Behaviours exploited: authority, intimidation, consensus/social proof, scarcity, urgency, familiarity, trust, greed.

Exam angle

PredictionQ1

"I’m the CEO and need this password NOW" exploits:

Slide 12 / 47

Behaviors Vulnerable to Attacks

Slide 12: Behaviors Vulnerable to Attacks
Slide 13 / 47

Factors that Make Companies Vulnerable to Attacks

Slide 13: Factors that Make Companies Vulnerable to Attacks
Slide 14 / 47

 Several Organizational Units Some organizations have their units at

Slide 14:  Several Organizational Units Some organizations have their units at
Slide 15 / 47

Why is Social Engineering Effective?

Slide 15: Why is Social Engineering Effective?

Notes

  1. Why it works: no software stops it, people want to help, lack of training, no detection.

Slide 16 / 47

Phases of a Social Engineering Attack

Slide 16: Phases of a Social Engineering Attack
Slide 17 / 47

Types of Social Engineering

Slide 17: Types of Social Engineering
Slide 18 / 47

An attacker can perform human-based social engineering by using the following techniques: • Impersonating

Slide 18: An attacker can perform human-based social engineering by using the following techniques: • Impersonating
Slide 19 / 47

Impersonation

Slide 19: Impersonation

Notes

  1. Impersonation: pretending to be someone (IT, a vendor, an executive). Vishing = voice phishing over the phone.

Slide 20 / 47

Impersonation (Vishing)

Slide 20: Impersonation (Vishing)
Slide 21 / 47

Human-based Social Engineering: Eavesdropping, Shoulder Surfing and Dumpster Diving

Slide 21: Human-based Social Engineering: Eavesdropping, Shoulder Surfing and Dumpster Diving

Notes

  1. Eavesdropping, shoulder surfing, dumpster diving, tailgating (following someone through a door), piggybacking (with permission).

  2. Trap Tailgating = without the employee’s consent; piggybacking = the employee knowingly lets you in.

Exam angle

PredictionQ1

Following an employee through a secure door without their knowledge is:

Slide 22 / 47

Human-based Social Engineering: Reverse Social Engineering, Piggybacking, and Tailgating

Slide 22: Human-based Social Engineering: Reverse Social Engineering, Piggybacking, and Tailgating
Slide 23 / 47

▪ Computer-based Social Engineering

Slide 23: ▪ Computer-based Social Engineering
Slide 24 / 47

Computer-based Social Engineering

Slide 24: Computer-based Social Engineering

Notes

  1. Computer-based: phishing (mass email), spear phishing (targeted), whaling (executives), pop-ups, fake software.

Exam angle

PredictionQ1

A phishing email crafted for one specific CFO is:

Slide 25 / 47

Slide 25

Slide 25: Slide 25
Slide 26 / 47

Computer-based Social Engineering: Phishing

Slide 26: Computer-based Social Engineering: Phishing
Slide 27 / 47

▪ Mobile-Based Social Engineering

Slide 27: ▪ Mobile-Based Social Engineering
Slide 28 / 47

Mobile-based Social Engineering: Publishing Malicious Apps and Repackaging Legitimate App

Slide 28: Mobile-based Social Engineering: Publishing Malicious Apps and Repackaging Legitimate App
Slide 29 / 47

Mobile-based Social Engineering: Fake Security Applications

Slide 29: Mobile-based Social Engineering: Fake Security Applications
Slide 30 / 47

Mobile-based Social Engineering: SMiShing (SMS Phishing

Slide 30: Mobile-based Social Engineering: SMiShing (SMS Phishing
Slide 31 / 47

Insider Threat / Insider Attack

Slide 31: Insider Threat / Insider Attack

Notes

  1. Insider threat: current or former employees, contractors with legitimate access: the hardest to detect.

Slide 32 / 47

 Terminated Employees : Some employees take valuable information about the company with them when terminated. These employees access company s data even after termination using backdoors, malware, or their old ’ credentials because they are not disabled.

Slide 32:  Terminated Employees : Some employees take valuable information about the company with them when terminated. These employees access company s data even after termination using backdoors, malware, or their old ’ credentials because they are not disabled.
Slide 33 / 47

Companies where insider attacks are common include credit card companies, health-care companies, network service providers, as well as financial and exchange service providers.

Slide 33: Companies where insider attacks are common include credit card companies, health-care companies, network service providers, as well as financial and exchange service providers.
Slide 34 / 47

 Become Future Competitor Current employees may plan to

Slide 34:  Become Future Competitor Current employees may plan to
Slide 35 / 47

Countermeasures

Slide 35: Countermeasures
Slide 36 / 47

Social Engineering Countermeasures

Slide 36: Social Engineering Countermeasures

Notes

  1. Countermeasures: training and awareness, policies, verification procedures, least privilege, physical controls, shredding.

Slide 37 / 47

Social Engineering Countermeasures (Cont’d)

Slide 37: Social Engineering Countermeasures (Cont’d)
Slide 38 / 47

Insider Threats Countermeasure

Slide 38: Insider Threats Countermeasure
Slide 39 / 47

How to Detect Phishing Emails

Slide 39: How to Detect Phishing Emails

Notes

  1. Spot phishing: mismatched sender or link URLs, urgency, spelling errors, unexpected attachments, requests for credentials.

Slide 40 / 47

Anti-Phishing Toolbar

Slide 40: Anti-Phishing Toolbar
Slide 41 / 47

Social Engineering Pen Testing

Slide 41: Social Engineering Pen Testing

Notes

  1. SE pen testing: phishing campaigns, phone pretexting, physical entry, USB drops (with written authorization).

Slide 42 / 47

Social Engineering Pen Testing (Cont’d)

Slide 42: Social Engineering Pen Testing (Cont’d)
Slide 43 / 47

Social Engineering Pen Testing: Using Phone

Slide 43: Social Engineering Pen Testing: Using Phone
Slide 44 / 47

Social Engineering Pen Testing: In Person

Slide 44: Social Engineering Pen Testing: In Person
Slide 45 / 47

Social Engineering Penetration Testing Tool

Slide 45: Social Engineering Penetration Testing Tool
Slide 46 / 47

Know What the Web Knows About You

Slide 46: Know What the Web Knows About You
Slide 47 / 47

Summary

Slide 47: Summary