Social Engineering

What You'll Learn

• Recognize common social engineering tactics including impersonation, urgency creation, and authority exploitation
• Identify red flags in unsolicited communications requesting sensitive information
• Understand proper verification procedures before sharing credentials or confidential data
• Learn how to use email security features like "Report Phishing" buttons effectively
• Master incident response procedures including password changes and two-factor authentication setup
• Develop awareness of how attackers gather information from public sources to make attacks more convincing

Training Steps

1. Introduction

   Alice Martinez works as a senior developer at SecureTech Corp, a growing software company specializing in financial applications. She's been with the company for three years and is known for being helpful and collaborative with her colleagues. It's a typical Tuesday afternoon, and Alice is working on a critical project deadline.

2. The Unexpected Call

   Alice's mobile phone rings unexpectedly. The caller ID shows 'IT Support - Internal'. Since Alice recognizes this as potentially being from her company's IT department, she decides to answer the call.

3. The Convincing Introduction

   Alice feels concerned about the potential security issue and wants to help resolve it quickly.

4. The Information Gathering

   Alice, feeling pressured by the urgency and trusting that this is legitimate IT support, begins to consider providing the requested information.

5. Escalating the Request

   Alice feels she has no choice but to comply since her account might be compromised.

6. The Malicious Website

   Alice notices the website looks similar to her company's login page, though something feels off about the URL.

7. The Access Attempt

   Bob has successfully captured Alice's credentials and is now attempting to get her to download malware disguised as a security tool.

8. Checking the Email

   After the call, Alice opens her email client to check for the promised message. Among her inbox, she notices an email from 'IT Support' with the subject line 'Urgent: Security diagnostic tool.'

9. The Realization

   As Alice hangs up the phone, memories from the company's recent cybersecurity training flood back. She remembers the instructor specifically warning about attackers who impersonate IT support, create false urgency, and try to get employees to download malicious software.

10. Immediate Security Response

    Alice immediately takes action to minimize potential damage from the attack. She knows that she has already provided her credentials to the malicious website, which means her account could be compromised. She also makes a mental note of all the information she provided during the call: her employee ID, last four digits of her SSN, and her login credentials.

Knowledge Check Questions

This training includes a 6-question quiz to test your understanding of Social Engineering threats and defenses.

• What is 'Social Engineering' in the context of cybersecurity?
• Which of the following are common tactics used in social engineering attacks? (Select all that apply)
• You receive a phone call from someone claiming to be from your company's IT department, asking for your password to 'troubleshoot a network issue'. What should you do?
• What makes human beings a target for social engineering attacks?
• Which of these are effective measures to defend against social engineering attacks? (Select all that apply)