Ethical Hacking Social Engineering Syllabus

What is Business Email Compromise (BEC)?

A targeted attack where an attacker impersonates a trusted executive or vendor (often via a spoofed or compromised email account) to trick employees into transferring money or sharing sensitive data. Also called CEO fraud.

List common red flags that indicate a phishing email.

Generic greetings, urgency/threats, sender address mismatches, spelling/grammar errors, mismatched or hovering-revealed suspicious URLs, unexpected attachments, requests for credentials or money, and 'too good to be true' offers.

What is 'clone phishing'?

An attack where a legitimate, previously delivered email is copied ('cloned') and its links/attachments are replaced with malicious versions, then resent from a spoofed address appearing to be the original sender.

What is pharming, and how does it differ from phishing?

Pharming redirects victims from legitimate websites to fraudulent ones by poisoning DNS or altering host files — no click on a bait link is required. Phishing relies on luring the victim to click a deceptive link.

What is pretexting?

A social engineering technique where the attacker fabricates a believable scenario or false identity (a 'pretext') to gain the victim's trust and extract information or access — e.g., posing as a bank auditor or IT technician.

How does pretexting differ from phishing?

Pretexting centers on building a fabricated but credible backstory/scenario over an interaction to establish trust, often two-way and research-heavy. Phishing typically relies on a single deceptive message impersonating a trusted brand.

What is 'impersonation' in social engineering?

Assuming a false identity — such as an employee, contractor, IT support, delivery person, or authority figure — to gain trust and access to information, systems, or restricted physical areas.

What is baiting?

An attack that lures victims with something enticing (physical or digital) to trigger a compromise — e.g., leaving malware-infected USB drives labeled 'Payroll' in a parking lot, or offering free movie/software downloads that carry malware.

How does baiting differ from quid pro quo?

Baiting relies on the victim's greed/curiosity by dangling an attractive item they take on their own initiative. Quid pro quo offers a service/benefit in direct exchange for information or an action requested by the attacker.

Why are USB drops (a form of baiting) effective?

They exploit human curiosity and helpfulness. Studies show a large percentage of found USB drives are plugged in by finders, executing malware or auto-run payloads that give attackers a foothold inside the network.

What is tailgating (piggybacking)?

A physical social engineering attack where an unauthorized person follows an authorized individual through a secured entrance — e.g., slipping through a door someone else badged open, often while posing as a delivery worker or carrying items.

What is the subtle difference between tailgating and piggybacking?

In tailgating the authorized person is unaware they are being followed. In piggybacking the authorized person knowingly grants access (e.g., holds the door out of courtesy). Both bypass physical access controls.

What physical security controls help prevent tailgating?

Mantraps/access-control vestibules, turnstiles, badge readers with anti-passback, security guards, visitor escort policies, CCTV, and employee awareness to challenge unbadged strangers ('challenge culture').

What is a mantrap (access-control vestibule)?

A small space with two interlocking doors where the second door cannot open until the first is closed and the person is authenticated, allowing only one person through at a time to prevent tailgating.

What is the primary purpose of Security Awareness Training?

To educate employees to recognize, resist, and report social engineering attacks — transforming the human weakest link into a 'human firewall' and building a security-conscious organizational culture.

What are effective components of a security awareness program?

Regular training sessions, simulated phishing campaigns, clear reporting procedures, policy education, role-based training, gamification, ongoing reinforcement, and metrics to measure improvement over time.

What is a simulated phishing campaign and why is it used?

A controlled, fake phishing exercise sent to employees to measure susceptibility and provide teachable moments. It identifies at-risk users, reinforces training, and tracks the click/report rate over time.

Define the phishing 'click rate' and 'report rate' metrics.

Click rate = percentage of recipients who clicked the simulated phishing link (lower is better). Report rate = percentage who correctly reported the email to security (higher is better). Both gauge awareness program effectiveness.

How is the phishing simulation click rate calculated?

$$\text{Click Rate} = \frac{\text{Number of users who clicked}}{\text{Total number of recipients}} \times 100\%$$

What is email filtering and what does it protect against?

The automated screening of inbound/outbound email to block spam, phishing, malware, and spoofed messages before they reach users' inboxes — a key technical defense layer against email-based social engineering.

What are SPF, DKIM, and DMARC?

Email authentication protocols. SPF (Sender Policy Framework) verifies sending IPs are authorized for a domain. DKIM (DomainKeys Identified Mail) adds a cryptographic signature verifying integrity/origin. DMARC ties SPF/DKIM together with a policy for handling failures and reporting.

What does the DMARC 'p=' policy tag control, and what are its values?

It tells receivers how to handle messages that fail authentication. Values: p=none (monitor only), p=quarantine (mark as spam/junk), and p=reject (block the message outright).

Name common techniques used by email filters to detect phishing.

Sender authentication (SPF/DKIM/DMARC), reputation/blocklists (RBLs), keyword and heuristic analysis, URL/link scanning and sandboxing, attachment scanning, machine-learning content classifiers, and anti-spoofing/display-name checks.

What is email sandboxing (detonation)?

A technique where suspicious attachments or links are opened/executed in an isolated virtual environment to observe behavior for malicious activity before delivering the message to the user.

What is the purpose of an Incident Response (IR) plan for social engineering?

To provide a predefined, structured procedure for detecting, containing, eradicating, and recovering from a successful social engineering attack, minimizing damage and enabling learning to prevent recurrence.

List the phases of the NIST/SANS incident response lifecycle.

1) Preparation, 2) Detection and Analysis (Identification), 3) Containment, 4) Eradication, 5) Recovery, 6) Post-Incident Activity (Lessons Learned). SANS lists six; NIST groups some into four phases.

What immediate steps should a user take after falling for a phishing attack?

Report it to security/IT immediately, disconnect the affected device from the network, change compromised credentials, preserve evidence (don't delete the email), and monitor accounts for suspicious activity.

What is the difference between containment and eradication in IR?

Containment limits the spread/damage of an incident (isolating systems, disabling accounts) to stop it worsening. Eradication removes the root cause and artifacts (malware, backdoors, attacker access) from the environment entirely.

Why is the 'Lessons Learned' (post-incident) phase important?

It reviews what happened, how it was handled, and how defenses can improve. Findings feed back into policies, awareness training, and controls to reduce the likelihood and impact of future social engineering incidents.

What is 'reverse social engineering'?

An attack where the attacker manipulates the victim into initiating contact and asking for help. Typically involves three steps: sabotage (create a problem), advertising (pose as the fixer), and assisting (extract info while 'helping').