Security+ SY0-701 - Chapter 4

CompTIA Security+ Study Guide Exam SY0-701

Social Engineering

The practice of manipulating people through a variety of strategies to accomplish desired actions.

Human Error

The vulnerability social engineering seeks to exploit.

Key Principles of Social Engineering

Authority, Intimtidation, Consensus-based, Scarcity, Familiarity-based, Trust, and Urgency

Authority

The principle of social engineering that relies on the fact that most people will obey someone who appears to be in charge or knowledgeable.

Intimidation

The principle of social engineering that relies on bullying an individual into taking a desired action.

Consensus-based

The principle of social engineering that relies on the fact that people tend to want to do what others are doing.

Scarcity

The principle of social engineering that uses the idea of missing out on something to persuade action.

Familiarity-based

The principle of social engineering that relies on amiable relations between the threat actor and target to persuade action.

Trust

The principle of social engineering in which the threat actor builds a connection with their target so that they will take the actions they want them to take.

Urgency

The principle of social engineering that relies on creating a feeling that action must be taken quickly.

Phishing

The fraudulent acquisition of information including, but not limited to: usernames, passwords, and credit card numbers; by means of email.

Spear Phishing

A type of phishing in which a specific individual is targeted in an attempt to gather desired information or access.

Whaling

A type of phishing in which an important person in an organization (usually someone in a C-Suite position) is targeted for the information or access they possess.

Awareness

What is one of the most common defenses against all types of phishing attacks?

Vishing

The fraudulent acquisition of information including, but not limited to: usernames, passwords, and credit card numbers; by means of phone calls.

Smishing

The fraudulent acquisition of information including, but not limited to: usernames, passwords, and credit card numbers; by means of text messages.

Misinformation

Incorrect information, often resulting from getting the facts wrong.

Disinformation

Incorrect, inaccurate, or outright false information that is intentionally provided to serve an individual or organization’s goals.

Malinformation

Information which is based on fact, but removed from its original context in order to mislead, harm, or manipulate.

Acronym: MDM

Misinformation, Disinformation, and Malinformation

1. Tell your story

2. Ready your team

3. Understand and assess MDM

4. Strategize response

5. Track outcomes

The five-step process to counter MDM campaigns.

TRUST

The acronym for the five-step process to counter MDM campaigns.

Impersonation

Pretending to be someone else.

Identity Fraud/Theft

The use of someone else’s identity.

Acronym: BEC

Business Email Compromise

Business Email Compromise

The use of apparently legitimate email addresses to conduct scams and other attacks.

Multifactor authentication, Awareness training, and Policies that support appropriate use and behaviors.

Mitigation methods for business email compromise.

Pretexting

The process of using a made-up scenario to justify why approaching an individual is warranted.

Watering Hole Attack

Using websites that targets frequent to attack them.

Brand Impersonation/Spoofing

An attack that uses emails or other correspondence that intentionally appear to be from a legitimate brand to prompt action.

Typosquatting

An attack that uses misspelled and slightly off, but similar to legitimate URLs to direct victims to sites they did not intend to go to.

Pharming

An attack that hijacks a system’s DNS configuration to redirect victims to sites they did not intend to go to.

Brute-force, Password praying, and Dictionary

Types of password attacks.

Brute-force

A type of password attack that iterates through a large bank of passwords until a correct one is found.

Password Spraying

A type of brute-force password attack that attempts to use a single password or a small set of passwords against many accounts.

Dictionary

A type of brute-force password attack that uses a word bank to guess passwords.

Rainbow Table

A bank of precomputed hashes used to decode hashed password stores.

Hash

A one-way cryptographic function that takes an input and creates a unique and repeatable output.

Password Hash

Best practice for storing passwords to verify at login.