AP Cybersecurity Unit 1

Social engineering

Use of psychological tactics to manipulate user into elicitation, downloading malicious file, or clicking malicious link

elicitation

Elicitation getting user to reveal sensitive info

Intimidation

Threatening negative consequences for none compliance

Urgency

Creating reasons target should act quickly

Personal information

Name, phone, address, pet name, etc

Secure information

One time password or authentication code

Challenge question

Website identify check answered from personal information

Malware

Software installed by a download file or a clicked link

what are the three victim impacts, what victim gives, and what adversaries achieve?

Personal information:

• victim gave: name, number, address, etc…

• Adversaries get: impersonation, answer to challenge questions

Secure information:

• victim gave: OTP, authentication login code

• Adversaries get: can log in to a service as the user

Malware/malicious links:

• victim did: download malware/click link that installs malware

Adversaries get:

• software installed on device

• Info stolen from user web browser

• Victim directed to websites where their login credentials are captured

Phishing

Mass deceptive email to trick recipients into revealing credentials/clicking malicious links

Domain spoofing

Registering/faking a domain that closely resembles a legitimate one (google.com)

Typo squatting

Form of domain spoofing that substitutes visually similar characters (1 & I)

Credential harvesting

Stealing login credentials by directing user to fake login page