CompTIA Security+ Preparation · lesson 15 of 45 · 25 min
What Is Social Engineering?
Social engineering is the manipulation of people into performing actions or divulging confidential information. It exploits human psychology rather than technical vulnerabilities — making it one of the most effective and dangerous attack vectors.
No matter how strong your technical controls are, a single employee tricked into clicking a malicious link or revealing their password can bypass all of them. Security awareness training is the primary defense.
Why social engineering works
Attackers exploit predictable human tendencies: Authority (we comply with people in power), Urgency (we act fast under pressure), Social proof (we follow what others do), Liking (we help people we like), Scarcity (we fear missing out), and Reciprocity (we feel obligated to return favors).
Phishing Attack Types
Other Social Engineering Techniques
Indicators of a Phishing Email
Training users to recognize phishing indicators is the most effective defense. Key red flags:
Phishing red flags
- Urgency / fear — “Your account will be suspended in 24 hours!”
- Mismatched sender domain — display name says “PayPal” but email is from paypa1-support.ru
- Generic greeting — “Dear Customer” instead of your name
- Suspicious links — hover reveals a different URL than displayed
- Unexpected attachments — especially .exe, .zip, .docm files
- Requests for credentials or payment — legitimate services never ask for passwords via email
- Poor grammar/spelling — though AI-generated phishing is now grammatically perfect
Defenses Against Social Engineering
Flashcard Drill
Phishing Mass email attack with malicious links or attachments targeting anyone. Spear phishing Targeted phishing using personalized information about a specific victim. Whaling Spear phishing targeting executives — CEO, CFO, board members. Vishing Voice phishing — phone calls impersonating trusted entities. Smishing SMS phishing — malicious links delivered via text message. BEC Business Email Compromise — impersonating an executive to authorize fraudulent wire transfers. Pretexting Creating a fabricated scenario to manipulate someone into revealing information. Baiting Leaving infected media (e.g. USB drives) for victims to find and use. Tailgating Following an authorized person through a secure door without badging in. DMARC Email authentication protocol that prevents domain spoofing — a key anti-phishing control.
Scenario Practice
The Urgent Wire Transfer
Process the wire transfer — the CEO is the boss. This is a BEC attack. Verify by calling the CEO directly on a known phone number before taking any action. Reply to the email asking for more details. Forward the email to the vendor to confirm. 1 This is a classic Business Email Compromise (BEC) attack. The attacker spoofed or compromised the CEO’s email. Key red flags: urgency, unusual request, request to bypass normal process. Always verify financial requests via a separate, known communication channel — never reply to the suspicious email.
The USB Drive
This is fine — she is trying to help return it. This is a baiting attack. The USB likely contains malware. She should hand it to IT security without plugging it in. She should copy the files to a shared drive so everyone can see them. She should plug it in but only open .txt files. 1 This is a textbook baiting attack. Attackers deliberately label USB drives with enticing names and leave them where targets will find them. Plugging in an unknown USB can execute malware automatically (autorun) or when files are opened. Always hand unknown media to IT security.
Knowledge Check
Social Engineering — 10 Questions
A targeted phishing attack that uses personal information about a specific employee is called:
- Whaling
- Vishing
- Spear phishing
- Smishing
- Answer: Spear phishing
Spear phishing is personalized and targeted at a specific individual, unlike broad phishing campaigns. An attacker calls an employee pretending to be IT support and asks for their password to “fix an issue.” This is:
- Smishing
- Vishing
- Baiting
- Pharming
- Answer: Vishing
Vishing is voice phishing — using phone calls to manipulate victims into revealing information.
DMARC, DKIM, and SPF are email authentication protocols that help prevent domain spoofing.
- True
- False
Answer: True
DMARC, DKIM, and SPF work together to authenticate email senders and prevent attackers from spoofing legitimate domains.
An attacker leaves USB drives labeled “Payroll” in a company parking lot. This is:
- Pretexting
- Tailgating
- Baiting
- Shoulder surfing
- Answer: Baiting
Baiting uses physical media (USB drives, CDs) with enticing labels to lure victims into plugging them in.
Walking through a secure door behind an authorized employee without badging in is called _____.
Answer: tailgating
Tailgating (also called piggybacking) is physically following an authorized person through a secured entry point.
Which of the following are red flags of a phishing email? (Select all that apply)
- Urgent language threatening account suspension
- Email from CEO@company.com
- Mismatched sender domain
- Request for credentials via email
- Personalized greeting with your name
Answer: Urgent language threatening account suspension
Mismatched sender domain
Request for credentials via email Urgency, mismatched domains, and credential requests are classic phishing indicators. A legitimate email from the correct domain with your name is not inherently suspicious.
Business Email Compromise (BEC) most commonly targets which department?
- IT security
- Human resources
- Finance / accounts payable
- Marketing
Answer: Finance / accounts payable
BEC attacks impersonate executives to trick finance staff into authorizing fraudulent wire transfers.
Which social engineering technique involves creating a fabricated scenario to extract information?
- Baiting
- Pretexting
- Pharming
- Watering hole
Answer: Pretexting
Pretexting involves inventing a believable story (pretext) to manipulate the victim into providing information or access.
MFA is an effective compensating control against phishing because even if credentials are stolen, the attacker cannot log in without the second factor.
- True
- False
Answer: True
MFA significantly reduces the impact of credential theft from phishing — the attacker needs the second factor too.
A watering hole attack compromises:
- A victim’s email account
- A website frequently visited by the target group
- A USB drive left in a parking lot
- A phone call to the victim
- Answer: A website frequently visited by the target group
Watering hole attacks infect websites that the target group regularly visits, waiting for victims to come to the attacker.
Try it: Social engineering types
Previous lesson: Indicators of compromise (IoC) and indicators of attack (IoA)
Back to CompTIA Security+ Preparation
Next lesson: Malware types: virus, worm, trojan, ransomware, rootkit, spyware, keylogger, botnet