Critical Thinking 2-2: Social Engineering Psychological Approaches

Several basic principles or reasons make psychological social engineering effective. These include authority, intimidation, consensus, scarcity, urgency, familiarity, and trust. Table 2-6 uses these principles in a scenario of an attacker pretending to be the chief executive officer (CEO) calling the organization's help desk to have a password reset. Create two additional scenarios, such as an attacker impersonating a help desk employee who wants access to an employee's protected information, and create a dialog example for each of the seven principles.

Table 2-6 Social engineering effectiveness Principle Description Example Authority Directed by someone "I'm the CEO calling." impersonating an authority figure or falsely citing their authority Intimidation To frighten and coerce by threat "If you don't reset my password, I will call your supervisor." Consensus Influenced by what others do "I called last week and your colleague reset my password." Scarcity Something is in short supply "I can't waste time here." Urgency Immediate action is needed "My meeting with the board starts in 5 minutes." Familiarity Victim is well-known and well "I remember reading a good evaluation on received you." Trust Confidence "You know who I am