An enterprise security analyst is investigating an incident where several finance department employees received unexpected phone calls from an individual claiming to be a senior IT support engineer. The caller stated that an emergency payroll system update required immediate phone-based password confirmation to avoid halting monthly salary disbursements. Which TWO of the following social engineering attack vectors or principles of influence were directly utilized in this scenario?
- Vishing, by conducting voice-based telephone calls to coax targets into revealing sensitive credentialsCevap
- Urgency, by threatening imminent disruption to salary disbursements if employees failed to act immediatelyCevap
- CTailgating, by physically following an authorized employee into a secured payroll operations center
- DWatering hole attack, by injecting malicious code into an external finance news portal regularly visited by employees
Cevap
The scenario demonstrates vishing (using voice calls over the telephone to gather credentials) and urgency (forcing quick compliance by threatening immediate financial process delays).
Vishing is correct because the social engineering attack was executed over the telephone using voice communications. Urgency is correct because the attacker exploited panic and pressure by fabricating a time-critical situation involving employee payroll delays to force immediate compliance.
Adım Adım Çözüm
Anahtar Kavram
Differentiating social engineering delivery vectors (vishing) and psychological principles of influence (urgency).