The human attack surface: social engineering in all its variants, open-source intelligence gathering, password attacks, wireless threats, and the emerging role of AI in both offense and defense.
Social engineering attacks exploit human psychology rather than technical vulnerabilities. The attacker manipulates a person into divulging credentials, granting access, or taking an action that benefits the attacker. No password strength or firewall rule stops a well-crafted social engineering attack — the vulnerability is the person, not the system.
| Variant | Channel | Distinguishing feature |
|---|---|---|
| Phishing | Mass, generic ("Dear Customer"). No personalization. | |
| Spear-phishing | Targeted by name, role, or recent activity. Uses OSINT to personalize. | |
| Whaling | Spear-phishing targeting C-suite executives or high-value individuals. | |
| Vishing | Voice (phone) | Attacker calls posing as IT support, bank, or authority. May use voice cloning. |
| Smishing | SMS / text | Malicious links or requests delivered via text message. |
| Pretexting | Any | Attacker creates a fabricated scenario (pretext) — e.g., impersonating a vendor, auditor, or co-worker — to extract information. |
| Intimidation | Any | Uses fear, urgency, or threats to pressure the victim into compliance. Common in tech-support scams and ransomware extortion. |
Exam trap: Phishing vs. spear-phishing vs. whaling is determined by targeting level, not content. A well-crafted email to a named senior manager is spear-phishing if it targets an individual, whaling if the target is an executive. The email channel is shared across all three.
Social engineering scenarios exploit two psychological levers: urgency ("Your account will be locked in 24 hours") and authority ("This is your IT department — comply now"). Either lever can appear in any variant. The exam will describe a scenario and ask you to identify both the attack type and the psychological technique used.
OSINT is the practice of collecting publicly available information about a target before launching an attack — the reconnaissance phase of the kill chain (see Unit 2). Attackers use OSINT to craft convincing spear-phishing emails: they look up the target's name, job title, colleagues, recent projects, and personal interests from LinkedIn, company websites, social media, and public records.
Defensive implication: Reducing public exposure (limiting what employees share on social media, scrubbing org charts from public websites) directly reduces OSINT effectiveness. Security awareness training teaches employees to recognize when they are being profiled.
Password attacks attempt to gain unauthorized access by cracking or guessing credentials.
| Attack | Mechanism | Countermeasure |
|---|---|---|
| Brute force | Tries every possible combination of characters systematically. | Account lockout after N failed attempts; long/complex passwords. |
| Dictionary attack | Tries a wordlist of common passwords and words (faster than full brute force). | Require non-dictionary complexity; lockout policies. |
| Credential stuffing | Replays username/password pairs stolen from a previous breach on other services. | MFA; unique passwords per site (password manager). |
| Password spraying | Tries one or a few common passwords (e.g., "Summer2024!") across many accounts to avoid lockout. | Lockout policies that count per-account AND per-source-IP; MFA. |
Key distinction: Brute force targets one account with many passwords. Password spraying targets many accounts with one password. This distinction determines which lockout policy is effective.
Wireless networks present a distinctive attack surface because radio signals extend beyond physical boundaries.
Artificial intelligence amplifies both offense and defense in cybersecurity — a recurring exam theme.
Original Practice Scenario · Tian2 AP
Scenario: An employee at a regional bank receives a phone call from someone claiming to be from the bank's IT helpdesk. The caller says: "We've detected unusual activity on your account. To protect you, I need to verify your employee ID and reset your VPN credentials — this must be done in the next 10 minutes or your access will be suspended." The employee provides the information.
(A) Identify the type of social engineering attack.
Vishing — the attack was conducted over a voice call. The caller also employed pretexting (fabricated authority as an IT helpdesk agent) and urgency tactics (10-minute deadline, threat of suspension).
(B) Identify two psychological techniques used and explain how each increases the attack's effectiveness.
Urgency: The 10-minute deadline prevents the target from pausing to verify the caller's identity. Fear of losing access overrides the normal instinct to question unusual requests.
Authority: Impersonating the IT helpdesk leverages the target's tendency to comply with requests from legitimate-seeming internal authority figures. The victim is less likely to question someone who appears to know institutional processes.
(C) Recommend one technical and one non-technical control to reduce the likelihood of this attack succeeding.
Technical: Implement MFA for VPN access. Even if credentials are compromised by vishing, the attacker cannot access the VPN without the second factor (e.g., an authenticator app push notification to the legitimate employee's phone).
Non-technical: Security awareness training that teaches employees to hang up and call back using the IT helpdesk's official number to verify any caller claiming to be internal IT. No legitimate IT department requires credentials over an unsolicited call.