A friendly request for the sales file
An email arrives: "Hi, I am the new finance manager. Please send me the full customer sales file today. I need it before the board meets."
The email is friendly and in a hurry. The analyst wants to help.
No computer was hacked. A person was tricked. Today you learn the many ways this is done.
Key words
| Word | What it means |
|---|---|
| Social engineering | Tricking a person into giving access or data. |
| Phishing | A fake email sent to many people to steal data or money. |
| Spear phishing | A fake email written for one chosen person or group. |
| Smishing | Phishing by text message (SMS). |
| Vishing | Phishing by phone call (voice). |
| Pharming | Sending you to a fake website even when you type the right address. |
| Watering hole attack | Infecting a website that a chosen group often visits. |
| USB baiting | Leaving an infected USB stick where someone will find it and plug it in. |
| Spoofing | Making a message or website look like it comes from someone you trust. |
| Network | Computers joined together so they can share data. |
| DNS | Domain name system: the service that turns a website name into a number a computer can find. |
| Malware | Harmful software. |
| Urgency | A feeling that you must act now. |
The cells students fill in are left blank in this preview.
By the end of this lesson
Note
I can name seven social engineering attacks, say how each tricks a person and give one defence for each.
Starter: what you already know
Have a go
Starter: what you already know
3 questionsYour answers are marked here and are not kept. A college account keeps every student’s marks.
Fooling a person is often easier than hacking
It is often easier to fool a person than to break a system.
Social engineers use feelings: urgency ("act now"), fear ("your account is closed"), greed ("you won a prize") and helpfulness ("please help me").
They often spoof a trusted name, such as your bank, a boss or the company.
The phishing family
Phishing: a fake email sent to thousands. Most ignore it. A few click.
Spear phishing: the email is written for one person. It uses their name, job and real details. It is far more believable.
Smishing: the same trick in a text message. "Your parcel is held. Pay 1 pound here."
Vishing: the same trick on a phone call, like a caller asking for a password reset.
Three more tricks
Pharming: you type the right web address but land on a fake site, because the address was changed behind the scenes. The next lesson explains how.
Watering hole attack: the attacker infects a website that your group often uses, such as a public statistics site that analysts visit. Visitors catch the malware.
USB baiting: an infected USB stick is left in a car park with a label like "Salaries". Someone plugs it in.
Impact and defence
| Attack | Impact | Defence |
|---|---|---|
| Phishing | Stolen passwords or money | Check the sender and link. Report it. Staff training |
| Spear phishing | A targeted breach, such as data sent away | Ask a second way, such as a call to a known number |
| Smishing | Stolen card or login | Never follow links in unexpected texts |
| Vishing | Passwords reset for a stranger | Check the caller's identity by a known number |
| Pharming | Logins stolen on a fake site | Check the address with care, use MFA, protect the DNS |
| Watering hole | Malware on many computers | Updates, anti-malware, a web filter |
| USB baiting | Malware inside the network | Never plug in unknown USB sticks. Block USB ports |
The cells students fill in are left blank in this preview.