An enterprise security analyst is investigating an incident where several finance department employees received unexpected phone calls from an individual claiming to be a senior IT support engineer. The caller stated that an emergency payroll system update required immediate phone-based password confirmation to avoid halting monthly salary disbursements. Which TWO of the following social engineering attack vectors or principles of influence were directly utilized in this scenario?
- Vishing, by conducting voice-based telephone calls to coax targets into revealing sensitive credentialsAnswer
- Urgency, by threatening imminent disruption to salary disbursements if employees failed to act immediatelyAnswer
- CTailgating, by physically following an authorized employee into a secured payroll operations center
- DWatering hole attack, by injecting malicious code into an external finance news portal regularly visited by employees
Answer
The scenario demonstrates vishing (using voice calls over the telephone to gather credentials) and urgency (forcing quick compliance by threatening immediate financial process delays).
Vishing is correct because the social engineering attack was executed over the telephone using voice communications. Urgency is correct because the attacker exploited panic and pressure by fabricating a time-critical situation involving employee payroll delays to force immediate compliance.
Step-by-Step Solution
Key Concept
Differentiating social engineering delivery vectors (vishing) and psychological principles of influence (urgency).