Social Engineering
Searching through trash to find information that can be used for attacks.
What is Dumpster Diving?
Stealing laptops, mobile devices, or storage media. Impact includes direct loss of sensitive data.
What is theft of devices?
This phase of hacking involves creating a way for the attacker to re-enter the system later.
What is creating a backdoor?
A text scam falls under this type of phishing.
What is smishing?
Regular training on recognizing and reporting suspicious behavior falls under this type of physical security preventative measure.
Employee Training
Standing behind somenoe to see what theya re typing to get information like ATM, password login, entry access code pads.
Shoulder Surfing
Employees or contractors who misuse access for malicious purposes.
What are insider threats?
A combination of tools and techniques used to create a full profile of the organization’s security posture.
What is reconnaissance/footprinting
This type of scam is usually done through email, and tries to convince someone to give up information or click on a link.
What is phishing?
Check-in processes and visitor badges falls under this type of preventative measure.
What are access controls?
Creating a believable story either in person or electronically from information you've gathered to act like a person in authority or to create an emergency.
What is pretexting?
Events like floods or earthquakes
What are natural disasters?
Information provided during the scanning/probing phase can give hackers insight into how to achieve this phase.
What is gaining access?
This type of phishing is targeted toward a specific individual, organization, or business.
What is spear-phishing?
Physical keys and combination locks fall under this type of physical preventative measure.
What are controlled entry systems?
finding passwords or codes written on wall or in desk drawer would fall under this type of social engineering.
Finding Info written in workspace
Examples of this type of physical attack include breaking locks, exploiting weak entry points.
What is unauthorized access?
Deleting log files usually falls under this phase of hacking.
What is covering tracks?
An AI voice clone on a phone call falls under this type of phishing?
What is vishing?
CCTVs fall under this type of physical preventative measure?
Surveillance
Using fake or real messages to force users to take an action like installing fake software or pay a ransom.
What is scareware/ransomware?
Following behind someone else who has access to a building.
What is tailgating/piggybacking?
Ping sweeps, TCP/UDP scans, and operating system identification usually fall into this phase of hacking.
What is scanning?
A CEO, senator, or general would be an apt target of this type of phishing.
What is whaling?
Designing facilities to minimize unauthorized access points.
Environmental Design