Information Security Basics
Which of the following is an example of social engineering?
- ACalling an employee while claiming to be the system administrator and getting them to reveal their password "to deal with an outage"
- BEntering special strings into the input fields of a web application to manipulate its database without authorization
- CUsing a program to try password candidates one after another to find one that logs in
Show answer and explanation
Answer: A. Calling an employee while claiming to be the system administrator and getting them to reveal their password "to deal with an outage"
Social engineering is the general term for techniques that exploit people's psychology, habits and carelessness rather than technical means, to get them to reveal important information such as passwords or to perform actions. Examples include phone calls or emails from someone claiming to be an administrator, business partner or boss, peeking at someone's screen or keystrokes over their shoulder (shoulder surfing), and rummaging through discarded documents (dumpster diving). A typical feature is wording that leaves no time to think, such as "hurry," "urgent" or "keep this confidential." Countermeasures include setting and publicizing a rule never to give out passwords by phone or email, and verifying the other party's identity by contacting them through contact details already known, not the ones they provided. Phishing is also a kind of social engineering, since it deceives people. Entering special strings into input fields is a technical attack such as SQL injection, and trying candidates one after another is a brute-force attack.
- A. Correct. Deceiving people into revealing information is social engineering.
- B. Manipulating a database with special strings through input fields is a technical attack such as SQL injection.
- C. Trying password candidates with a program is a brute-force attack, an attack by technical means.