What is Social Engineering?
Social engineering exploits human psychology rather than technical vulnerabilities. Attackers manipulate people into revealing confidential information or performing actions that compromise security. Studies show that over 90% of data breaches involve a social engineering element — making this a critical topic for any ethical hacker.
Types of Social Engineering Attacks
|
Attack |
Description |
Defense |
|
Phishing |
Fake email tricking users to click malicious links |
Email filters, user training |
|
Spear Phishing |
Targeted phishing using personal info |
Verify sender, MFA |
|
Vishing |
Voice calls pretending to be IT/bank |
Call back policy, verify ID |
|
Smishing |
SMS-based phishing |
Don’t click unknown SMS links |
|
Pretexting |
Creating a fake scenario to extract info |
Information classification policy |
|
Baiting |
Leaving infected USB drives in public |
Never plug unknown USB devices |
|
Tailgating |
Following someone into a secure area |
Badge-only access, awareness |
|
Placement Tip: Explain the Phishing Attack Lifecycle in interviews: Reconnaissance → Crafting email → Sending → Victim clicks → Credential harvest → Attacker gains access. Know how SPF, DKIM, and DMARC email authentication records help prevent phishing. |