NWIT 246 - Ch. 3: Social Engineering & Physical Security

Social engineering

Definition: Manipulating people into doing things or giving info that benefits the attacker. It's an attack involving human interaction.

 

Memory Trick: It's an attack on PEOPLE, not computers - the "exploit" is trust, not code.

 

Exam Trap: If a question describes no technical hacking at all, just convincing someone to act, that's social engineering.

Moral obligation (manipulation tactic)

Definition: Exploits your willingness to help out of a sense of responsibility.

Innate human trust (manipulation tactic)

Definition: Using the right clothes, demeanor, and lingo so you trust and comply.

Threatening (manipulation tactic)

Definition: Intimidates you into complying.

Something for little to nothing (manipulation tactic)

Definition: Promises a huge reward for a tiny favor or trivial info.

Ignorance (manipulation tactic)

Definition: You don't know social engineering tactics, so you can't spot it.

 

Exam Trap: The 5 tactics are: Moral obligation, Innate human trust, Threatening, Something for little to nothing, Ignorance.

Research (Phase 1 - Social Engineering)

Definition: Footprinting: use every resource (websites, social media, dumpster diving, employee names/emails, tours). Feeds pretexting.

 

Memory Trick: Research = footprinting = gathering raw material before you build the fake story (pretext).

Development (Phase 2 - Social Engineering)

Definition: Pick targets (frustrated, overconfident, arrogant, easy to extract info from), then build a relationship and trust.

Exploitation (Phase 3 - Social Engineering)

Definition: Use the relationship to get info or access (passwords, USB with payload, infected attachment). Then exit smoothly and erase footprints.

 

Exam Trap: Order is always Research -> Development -> Exploitation. Pretexting needs research first, since you can't fake a believable scenario without it.

Shoulder surfing

Definition: Looking over your shoulder to get usernames, passwords, account numbers.

Eavesdropping

Definition: An unauthorized person listening to private conversations.

USB and keyloggers

Definition: On site: steal data with a USB drive, or capture logins with a keylogger.

Spam / Spim

Definition: Spam = email or banner ad with a bad link. Spim = the same thing, but over instant messaging.

 

Memory Trick: Spim = Spam over IM - same scam, different channel.

Hoax

Definition: A fake email with an urgent or alarming message. Often has bad spelling and grammar. Asking you to forward it to everyone you know is a classic tell.

 

Exam Trap: "Forward this to everyone you know" is the single biggest hoax giveaway, regardless of who supposedly sent it.

Insider (attacker type)

Definition: A customer, janitor, guard, but usually an employee: disgruntled, wants money, or bribed.

Unintentional threat actor

Definition: Harmless day-to-day work causes a breach - the most common insider threat (e.g. accidentally leaving a company laptop at a coffee shop).

 

Exam Trap: The MOST common insider threat is the unintentional threat actor, not a disgruntled or bribed employee.

Hacktivist (social engineering context)

Definition: A hacker with a political motive.

Script kiddie (social engineering context)

Definition: A hacker who uses others' scripts rather than writing their own.

White hat hacker (social engineering context)

Definition: A hacker who helps companies find flaws.

Cybercriminal

Definition: A hacker after big money who takes risks (corporate spies are a subtype).

Nation state (attacker type)

Definition: Highly targeted, all-out war, extremely motivated, most sophisticated (new apps and viruses), well financed.

Authority and fear (motivation technique)

Definition: Pretends to be a boss (or acts for one), often with threats of firing or demotion.

Social proof (motivation technique)

Definition: "Everybody's doing it, so it's okay."

Scarcity (motivation technique)

Definition: Something's in short supply. Appeals to greed.

Likeability (motivation technique)

Definition: People do more for someone they like.

Urgency (motivation technique)

Definition: A fake distress scenario pushing you to act now.

Common ground (motivation technique)

Definition: A shared hobby, experience, or problem builds an instant connection.

 

Exam Trap: The 6 techniques are: Authority and fear, Social proof, Scarcity, Likeability, Urgency, Common ground.

Opportunistic attack

Definition: Automated, scans many systems for known vulnerabilities (old software, open ports, defaults). Grabs what's easy, then leaves.

Targeted attack

Definition: Methodical, multiple entities with big resources, unknown exploits, custom programs, covers tracks. Much more dangerous.

 

Exam Trap: Targeted attacks use UNKNOWN exploits and custom tools - opportunistic attacks rely on KNOWN, already-patchable vulnerabilities.

Compliments (elicitation tactic)

Definition: Flatter something the target did so they elaborate.

Misinformation (elicitation tactic)

Definition: Say something wrong so the target corrects you with the accurate details.

Feigning ignorance (elicitation tactic)

Definition: Say something wrong, then admit not knowing, so the target explains in detail.

Good listener (elicitation tactic)

Definition: Listen, validate feelings, share (real or fake) experiences so the target opens up.

 

Exam Trap: Compliments, Misinformation, Feigning ignorance, and Good listener = the 4 ELICITATION tactics, which get info without raising suspicion.

Pretexting

Definition: Research used to build fake identities, stories, and scenarios.

Preloading

Definition: Sets up the target by influencing their thoughts, opinions, or emotions beforehand.

Impersonation

Definition: Pretending to be trustworthy with a legitimate-sounding reason to get info or access.

 

Exam Trap: Pretexting = building the fake story. Preloading = priming the target's emotions first. Impersonation = acting out the fake identity to get in.

Interview (social engineering)

Definition: The target talks, the attacker listens and learns.

Interrogation (social engineering)

Definition: The attacker leads with questions and statements toward the info they want. Works best when smooth and trust exists.

 

Exam Trap: Interview = attacker listens. Interrogation = attacker leads.

Phishing

Definition: Masquerades as a trustworthy entity in an electronic message.

Spear phishing

Definition: Targets one victim using info about them (like their bank). A fake site captures personal info.

Whaling

Definition: Targets senior executives and high-profile victims.

Vishing

Definition: Voice + phishing, using VoIP.

Smishing (SMS phishing)

Definition: An urgent text message with a link that installs malware or steals info.

Pharming

Definition: "Phishing without a lure." Malware redirects your legit URL to a fake site. Done by DNS cache poisoning (attacker changes the DNS table) or host file modification (malicious email attachment edits your local host file).

 

Exam Trap: If the scenario mentions a malicious attachment being opened = host file modification. No attachment, just "the site redirected me" = DNS cache poisoning. Being at home doesn't mean host file.

Social networking attack

Definition: Scams on Facebook, Instagram, etc. A bad link leads to a malicious site asking for personal info.

 

Exam Trap: Whaling = executives. Vishing = voice/VoIP. Smishing = SMS. Spim = instant messaging. Pharming = DNS cache poisoning or host file.

Physical security

Definition: Protecting property, facilities, equipment, and personnel from damage, theft, or harm. Inspections happen quarterly.

Prevention (security factor)

Definition: Safeguards that make the location less appealing to hackers / deter an attack.

Detection (security factor)

Definition: Identify what was broken into, what is missing, and the extent of damage, theft, or harm.

Recovery (security factor)

Definition: Review procedures, repair damage, get operational again, and harden against future problems.

 

Exam Trap: Prevention, Detection, Recovery = Security FACTORS. Don't confuse with the Security SEQUENCE (Deter, Deny, Detect, Delay) - different category entirely.

Deter (security sequence)

Definition: Discourage initial access attempts.

Deny (security sequence)

Definition: Block direct physical access.

 

Exam Trap: A guard physically stopping/detaining someone = Deny, in the Security Sequence.

Detect (security sequence)

Definition: Notice the intrusion.

Delay (security sequence)

Definition: Slow the violator down for response time.

 

Memory Trick: The sequence auto-advances if a step fails: Deter -> Deny -> Detect -> Delay.

Man-made threat

Definition: Human-caused: theft, vandalism, destruction. Includes accidental causes too (e.g. an employee leaving a laptop at a coffee shop), not just malicious ones.

 

Exam Trap: An employee accidentally leaving a company laptop somewhere is still a MAN-MADE threat - it's human-caused even though it's accidental, not environmental or external.

External threat

Definition: A threat that originates outside the company, agency, or institution.

Environmental threat

Definition: Natural disasters: floods, fires, hurricanes/tornadoes, tsunamis, earthquakes, blizzards, electrical storms.

Cloud threat

Definition: Threats against cloud services/data - the cloud is susceptible to many threats.

Perimeter barriers (fences/dogs/lighting/guards)

Definition: Fences: low (3-4ft) = casual deterrent, 6-7ft = deters unless determined, 8ft+ barbed wire = effective. Guard dogs: reliable but costly/liability risk. Lighting: deters intruders and helps cameras work. Security guards: best option (active response, access list), but expensive/inconsistent.

CCTV camera types

Definition: Bullet: built-in lens, in/outdoor. C-mount: interchangeable lens, needs housing outdoors. Dome: vandal-resistant. PTZ: moves and zooms.

 

Memory Trick: Focal length (mm) = detail at distance. LUX: lower number is better in low light.

 

Exam Trap: Cameras only DETECT - they don't prevent or react. Guards are needed for that.

Mantrap

Definition: Two doors, single person, traps intruder if no auth.

Turnstile

Definition: One-direction entry.

Double-entry door

Definition: Emergency exit only, alarmed.

Piggybacking / tailgating

Definition: Following someone in without authorization.

 

Exam Trap: Mantraps and turnstiles are specifically what stop piggybacking/tailgating.

Pick-resistant lock

Definition: The most secure key lock, though it can still be shimmed.

Keypad lock

Definition: No lost keys possible.

Dumb card

Definition: A card with limited info.

Smart card

Definition: Encrypts its data, uses 13.56 MHz.

Proximity / RFID card

Definition: 125 kHz, ID only (no encryption).

 

Exam Trap: Smart card = encrypted. Proximity/RFID card = ID only, no encryption - don't mix the two up.

Biometric lock

Definition: Fingerprint, iris, retina, voice, or facial recognition.

Access log

Definition: A sign-in record on entry, kept by guards.

FAR (False Acceptance Rate)

Definition: An unauthorized person is wrongly let in.

FRR (False Rejection Rate)

Definition: An authorized person is wrongly rejected.

 

Exam Trap: FAR = lets the WRONG person IN. FRR = keeps the RIGHT person OUT.

CER (Crossover Error Rate)

Definition: The point where FAR = FRR; lower is better.

Anti-passback

Definition: Stops someone from passing a card to another person to use.

Photoelectric sensor

Definition: Used for perimeter motion detection.

Wave / heat / ultrasonic sensors

Definition: Used for interior motion detection.

PDS (protected distribution system)

Definition: Encases cabling in a carrier. Hardened = welded conduit with visual checks. Alarmed = electronic alarm instead of welds. Continuously viewed = guards watch it live.

Bump key

Definition: Cut to the #9 (lowest) position; bump/tap to jump the pins, creating a shear line.

Lock picking (scrubbing)

Definition: Tension wrench + pick. Scrubbing = scrape the pins fast while holding tension until they stick unlocked.

Lock shim

Definition: A thin, stiff piece of metal inserted into a padlock's latch.

Badge cloning

Definition: RFID badges are copyable: antenna + read/write device + blank card, get close to the real badge.

Cold boot attack

Definition: Pulls RAM data remanence before the system fully powers off.

BIOS access attack

Definition: Changes boot order to bypass the installed OS.

NIST

Definition: National Institute of Standards and Technology - the institute that publishes and standardizes the security controls and assessment procedures used to protect the integrity of information systems.

NIST SP 800-53

Definition: NIST's physical/info-security standard. Covers 5 areas: security controls, assessment procedures, operation protection, asset protection, individual protection.

 

Memory Trick: CAOAI: Controls, Assessment, Operation, Asset, Individual - "NIST checks the rules, then protects the running site, the stuff, and the people."

Incremental backup

Definition: Backs up everything changed since the last full OR incremental backup - fast backup, slow restore (has to replay every increment in order).

Differential backup

Definition: Backs up everything changed since the last full backup - fast restore (just the full backup + the latest differential), but grows larger all week.

 

Exam Trap: Incremental = fast backup, slow restore. Differential = fast restore (full + latest diff only), slower/bigger backups as the week goes on.

Media destruction - paper

Definition: Strip-cut = thin strips, can be reassembled. Crosscut = confetti, much harder to reassemble.

 

Exam Trap: Crosscut beats strip-cut against dumpster divers.

Media destruction - optical discs

Definition: Shred or crush - deleting or overwriting data isn't reliable since the disc can simply be destroyed instead.

 

Exam Trap: Shred/crush beats delete/overwrite for optical discs - and degaussing does NOT work on optical discs, only magnetic media.

Media destruction - magnetic media

Definition: Degauss HDDs, floppies, and tapes to destroy the data magnetically.

Workstation lock (screen saver timeout)

Definition: Set the screen saver/lock to require a password after a short idle period - the fix for someone who steps away without signing out.

 

Exam Trap: A strong password or MFA doesn't help here - those protect the login, not an unattended already-unlocked session.

Lab skill: spotting Phishing (general pattern)

Definition: A message claims to be from a trusted organization, but has spelling/grammar errors and the link doesn't actually point to that organization's real domain.

 

How to apply it: Hover over any link before clicking. If the real destination doesn't match the sender's claimed domain, treat it as phishing no matter how official the message looks - this works on any brand, not just the one in a specific lab.

 

Lab example: A "Microsoft Update Center" email whose link didn't actually point to Microsoft.

Lab skill: spotting a Malicious attachment (general pattern)

Definition: An email looks like it's from someone you know but doesn't actually answer what you asked, OR comes from a stranger with a vague/generic greeting - either way, it includes an attachment you weren't expecting.

 

How to apply it: Check whether the content actually matches the relationship. A mismatched reply or a generic greeting from a "known" sender is the tell - the attachment itself is just the payload.

Lab skill: spotting Whaling (general pattern)

Definition: A message specifically tailored to target executives or other high-profile individuals, often disguised as career/recruiting content or something else relevant to their seniority.

 

How to apply it: If a message is unusually specific to someone's rank or role rather than generic, that targeting itself is the red flag - regardless of the cover story used.

Lab skill: spotting Spear phishing (general pattern)

Definition: An email appears to come from a real colleague or contact, but the embedded link actually points to an unrelated or foreign domain, or straight to an executable file.

 

How to apply it: A familiar name in the "From" field doesn't guarantee the link goes where it should - always hover, even on emails from people you know.

Lab skill: spotting a Hoax (general pattern)

Definition: An alarming or urgent message (virus warning, prize offer, etc.) that explicitly instructs you to forward it to everyone you know.

 

How to apply it: Any "forward this to everyone" instruction is close to a guaranteed hoax, no matter what the message dangles (fear or reward) or who sent it.

Lab skill: verifying a Safe email (general checklist)

Definition: Two things make an email verifiably safe: (1) it has no link or attachment to act on at all, or (2) any link it does have can be independently verified - a digital signature confirming the real sender, and hovering shows a domain you already know and trust.

 

How to apply it: Don't trust "official-sounding" alone. Look for an actual verification mechanism before clicking, and remember a message that asks nothing of you is inherently lower risk.

Lab skill: overall takeaway from the inbox lab

Exam Trap: Across nearly every attack type, hovering over a link to see its REAL destination (not the displayed text) is what exposes the scam - this applies no matter what the lure is (bank, HR, prize, virus alert, a colleague's name).

Lab skill: matching control strength to asset value (general pattern)

Definition: A high-value interior target (server room, network closet, data room) should get access controls AT LEAST as strong as the main entrance - a room isn't automatically lower-priority just because it's not the front door.

 

How to apply it: When assigning a lock/control to any door in a new scenario, ask what's behind it, not just where it sits in the building.

 

Lab example: Both the front door and the Networking Closet got Smart Card Readers, not a weaker lock on the closet.

Lab skill: camera placement for a sensitive space (general pattern)

Definition: A camera outside a sensitive door captures anyone attempting entry; a camera inside captures what happens once someone gets in. Covering only one side leaves a blind spot.

 

How to apply it: For any new high-value room, plan camera coverage on both sides of the door, not just one - this applies to any room being hardened, not a specific closet.