What is social engineering?

Common Types of Social Engineering Attacks

1. Phishing

• Description: Fraudulent attempts to obtain sensitive information such as usernames, passwords, and credit card details by disguising as a trustworthy entity in electronic communications.


• Examples: Fake emails, websites, or text messages that appear to come from reputable sources.

2. Spear Phishing

• Description: A targeted phishing attack aimed at a specific individual or organization, often involving personalized information to make the deception more convincing.


• Examples: Emails that appear to come from a known colleague or business partner, containing information relevant to the victim.

3. Whaling

• Description: A type of spear phishing attack that targets high-profile individuals such as executives, CEOs, or other senior officials.


• Examples: Emails that appear to come from legal authorities or other executives, requesting sensitive information or authorizing financial transactions.

4. Pretexting

• Description: Creating a fabricated scenario or pretext to persuade someone to divulge information or perform an action.


• Examples: An attacker pretending to be a bank representative asking for account verification information.

5. Baiting

• Description: Offering something enticing to lure victims into a trap where they can be exploited.


• Examples: Free music downloads, software, or USB drives left in public places that contain malware.

6. Quid Pro Quo

• Description: Offering a service or benefit in exchange for information or access.


• Examples: An attacker posing as tech support offering to help with a computer issue in exchange for login credentials.

7. Tailgating

• Description: Gaining physical access to a restricted area by following someone with authorized access.


• Examples: An attacker pretending to be a delivery person and following an employee into a secured building.

Techniques Used in Social Engineering

1. Impersonation

• Description: Pretending to be someone else to gain the victim's trust.


• Examples: An attacker posing as an IT support technician to gain access to a user's computer.

2. Urgency

• Description: Creating a sense of urgency to prompt quick action without thorough consideration.


• Examples: Emails claiming that immediate action is required to avoid penalties or take advantage of a limited-time offer.

3. Authority

• Description: Leveraging perceived authority to gain compliance from the victim.


• Examples: An attacker posing as a senior executive demanding sensitive information from an employee.

4. Social Proof

• Description: Exploiting the human tendency to follow the actions of others, assuming that those actions are the correct behavior.


• Examples: Phishing emails claiming that many people in the organization have already taken an action and prompting the victim to do the same.

5. Scarcity

• Description: Creating a perception of scarcity to increase the victim's desire to act.


• Examples: Fake promotions claiming limited availability of a product or service.

Prevention and Protection

1. Education and Awareness

• Description: Training employees and individuals to recognize and respond to social engineering attempts.


• Strategies: Regular security awareness training, phishing simulation exercises, and up-to-date information on the latest social engineering techniques.

2. Verification Processes

• Description: Implementing verification steps to confirm the identity of individuals requesting sensitive information or access.


• Strategies: Using callback procedures, multi-factor authentication, and direct communication channels to verify requests.

3. Strong Policies and Procedures

• Description: Establishing and enforcing policies that minimize the risk of social engineering attacks.


• Strategies: Policies on sharing sensitive information, procedures for handling unexpected requests, and protocols for reporting suspicious activities.

4. Technical Controls

• Description: Implementing technical measures to reduce the risk of social engineering attacks.


• Strategies: Email filtering, anti-malware software, network segmentation, and access controls.

5. Incident Response Planning

• Description: Preparing for potential social engineering attacks by having a response plan in place.


• Strategies: Establishing clear reporting channels, conducting regular drills, and having a dedicated incident response team.