📖 What is Social Engineering?
Social Engineering is the psychological manipulation of people into performing actions or divulging confidential information. It leverages human trust and error rather than technical vulnerabilities, using techniques like phishing, pretexting, and baiting to gain unauthorized access.
"For the exam, distinguish between Phishing (email), Vishing (voice), and Smishing (SMS) to identify the correct attack vector used in a scenario."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Social Engineering?
- ▸ Psychological triggers like urgency, authority, and fear are used to bypass critical thinking and pressure victims into making quick, uninformed decisions.
- ▸ Phishing, Vishing, and Smishing represent the primary digital vectors, distinguished by their delivery methods via email, voice calls, and SMS messages respectively.
- ▸ Pretexting involves creating a detailed, fabricated scenario or persona to establish trust and manipulate a target into revealing sensitive corporate information.
- ▸ Physical social engineering techniques include tailgating and shoulder surfing, which allow attackers to bypass physical security controls and gain unauthorized facility access.
- ▸ Baiting leverages human curiosity by offering a perceived reward, such as a free software download or a physical USB drive, to install malware.
🎯 How does Social Engineering appear on the PT0-002 Exam?
You may be asked to identify the specific attack vector in a scenario where an attacker sends a text message urging a user to click a link to reset their password.
A scenario might describe an attacker calling a help desk while pretending to be a high-level executive to bypass password reset protocols; you must identify this as vishing.
Expect questions where you must choose the best mitigation strategy for an employee who allowed an unknown person to follow them into a secure server room.
❓ Frequently Asked Questions
What is the difference between tailgating and piggybacking?
Tailgating occurs when an unauthorized person follows someone through a door without their knowledge. Piggybacking happens when the authorized person knowingly allows the other person to enter, often out of politeness or social pressure.
Why is a Rules of Engagement (RoE) document critical for social engineering tests?
Because social engineering targets people, an RoE prevents legal issues and employee trauma by defining strictly what is off-limits, such as prohibited psychological triggers or specific restricted areas.