Social Engineering & Human Risk
This term refers to threats against human factors in the technology environment, using deception and trickery to gain access.
Social Engineering
A targeted phishing email scam directed specifically at high-value individuals, such as corporate executives.
Whaling
A security flaw, glitch, or weakness in software code that can be exploited by an attacker.
Vulnerability
The cybersecurity principle that dictates providing users with only the minimum system access necessary to perform their work.
Principle of Least Privilege
Physical devices embedded with sensors and software that connect and exchange data over networks and the internet.
Internet of Things (IoT)
The technique of following an authorized user into a secure area without presenting proper credentials.
Information gathered legally from free, public sources regarding an individual or organization.
OSINT (Open-Source Intelligence Tools)
The industry-standard database that maintains a reference index of known vulnerabilities in digital products.
CVE (Common Vulnerabilities and Exposures) database
The Windows feature that prompts a dialog box asking for user confirmation whenever an application attempts to make system-level changes.
UAC (User Account Control)
The specialized search engine used by researchers and attackers to scan the internet for connected, unmanaged devices.
Shodan
These misleading emails describe urban legends, impossible events, or damaging malware with the goal of frightening users into forwarding them.
A tool used to extract metadata—such as embedded camera models or exact GPS coordinates—from photo files.
ExifTool (or EXIF analysis)
The specific code or attack technique used to take advantage of a system weakness to execute an attack.
Exploit
The data protection rule recommending 3 copies of data, stored on 2 different devices, with 1 copy stored offsite or in the cloud.
3-2-1 Backup Rule
The October 2016 attack that infected IoT devices like cameras and routers to launch a massive DDoS attack against DNS provider Dyn.
Mirai Botnet attack
An attack technique where the cybercriminal crafts a scenario so that the victim is tricked into initiating the initial contact.
Reverse Social Engineering
Unsolicited commercial emails sent to many recipients at once that lack a sense of urgency or malicious intent.
Spam
The maximum severity score assigned to a vulnerability in the CVE database, representing a total compromise of confidentiality, integrity, and availability.
10.0
A specialized software patch released to fix a specific bug that is not distributed through standard automatic system updates.
Hotfix
The structured process of identifying potential security threats, assessing their likelihood and impact, and prioritizing defense mechanisms.
Threat Modeling
The complete three-step workflow required to achieve human risk mitigation in an organization: Set a policy, create a procedure, and perform this final step -
User Training
An online archive service used during OSINT research to view historical versions of websites that are no longer live.
Archive.org (or the Wayback Machine)
The 2008 Windows Server service vulnerability (CVE-2008-4250) that allowed remote code execution and was featured in Darknet Diaries Episode 57
MS08-067
Standardized lists of recommended configuration settings published by groups like CIS to evaluate device security posture.
Benchmarks
Two immediate configurations required to secure a newly installed IoT device's administrative interface.
Changing the default username and setting a unique, strong password.