Match each enterprise security incident scenario on the left with the specific social engineering attack vector utilized on the right.
- An attacker registers a domain name containing a common misspelling of a corporate web portal to harvest employee authentication credentials.Typosquatting
- An attacker leaves malware-infected USB flash drives scattered in the employee parking lot hoping someone inserts one into a company workstation.Baiting
- An attacker contacts a shipping department while impersonating a logistics dispatcher to trick staff into redirecting a valuable shipment to an offsite address.Diversion theft
- An attacker submits a fraudulent payment request to the accounts payable department designed to mimic a routine bill from an established third-party vendor.Invoice fraud
Answer
The credential harvesting site using a misspelled domain matches Typosquatting; the malware-laden flash drives left in the parking lot match Baiting; the fraudulent redirection of a shipment matches Diversion theft; and the fake vendor payment request matches Invoice fraud.
Each attack vector is correctly paired based on its primary delivery mechanism: Typosquatting uses deceptive URLs based on spelling errors; Baiting relies on physical media traps; Diversion theft manipulates physical delivery routes; and Invoice fraud uses deceptive billing requests to siphon corporate funds.
Step-by-Step Solution
Key Concept
Social Engineering Attack Vectors