1.1 Understanding Social Engineering

Social engineering is any attack that manipulates a person into doing what the attacker wants. Instead of breaking through a firewall, the attacker gets you to open the door. The goal is usually one of three things: getting you to reveal sensitive information, getting you to download a harmful file, or getting you to click a harmful link.

Getting information out of someone through conversation is called elicitation. A friendly stranger who asks where you work, what your dog's name is and when your birthday is might just be chatty, or might be collecting answers to your account's security questions.

Social engineering can happen face to face, but it usually arrives through email, text messages or social media messages. A scam email is called phishing. You may also hear smishing (by text) and vishing (by voice call), but the exam focuses on the tactics, not the channel names.

Attackers lean on normal human instincts. Two show up constantly.

Intimidation is a threat: do this, or something bad happens. It works because people naturally want to avoid negative consequences, and fear pushes them to act before they think. Examples: "Your account will be suspended," "You'll be reported to the police," "Your grade will be withheld."

Urgency is a time limit: do this right now. It works because people react fast to anything that feels time-sensitive, and that rush skips the step where you ask, "Does this make sense?" Examples: "within 30 minutes," "by the end of the day," "final notice."

Many scams use both at once, like "Pay within 24 hours or your service will be shut off." On the exam, separate them: the deadline is urgency, and the threatened consequence is intimidation.

• Personal details that let someone impersonate you: name, phone number, address, workplace, pets' names, birthdate. Many websites use exactly these as challenge questions to confirm who you are, so giving them away can let an attacker reset your password.
• A one-time password (OTP) or login code. That code is the second step that proves you are you. If you read it to someone, they can log in as you, even if they don't know your password.
• Malware. Opening an attachment or clicking a link can install software that takes over your device or steals data saved in your web browser, like saved passwords and cookies.
• Your password itself. A link can lead to a fake login page that looks real and captures whatever you type.

• Treat pressure as a warning sign. A real bank, school or employer can wait while you check.
• Verify through a separate channel. Call the number on the back of your card or type the website address yourself instead of using the link or number in the message.
• Never share a one-time code with anyone who contacts you. Legitimate support staff don't need it.
• Before clicking, check where a link really goes. Look at the host name (the part before the first single slash) and read it from the right. In login.example.com.account-check.example.net, the site belongs to example.net, not example.com; everything to the left is just labels the owner of example.net chose. (Some country addresses use three parts for the owner's name, like example.co.uk.)
• Report suspicious messages so others can be warned.