Identity Threats: Phishing & Social Engineering¶

Technology fails to a human who is tricked into handing over the keys. Social engineering is the #1 way attackers gain initial access.

Why It Works¶

Social engineering exploits psychology, not code:

Common Techniques¶

• Phishing — mass deceptive emails luring clicks/credentials.
• Spear phishing — targeted, personalized (researched victim).
• Whaling — targeting executives.
• Vishing — voice/phone-based.
• Smishing — SMS-based.
• Business Email Compromise (BEC) — impersonating an exec to authorize fraudulent payments. Often the costliest attack of all.
• Pretexting — inventing a scenario to extract info.
• Baiting — dropping malicious USB drives.
• Tailgating — following someone through a secure door.

Spotting a Phishing Email¶

🚩 Red flags:

• Mismatched/look-alike sender domain (micros0ft-support.com).
• Generic greeting, urgency, threats.
• Unexpected attachments or links (hover to inspect the real URL).
• Requests for credentials, MFA codes, or payment changes.
• Subtle grammar/branding errors.

Defenses — Technical + Human¶

Technical:

• Email authentication: SPF, DKIM, DMARC to block spoofed senders.
• Link/attachment sandboxing and filtering.
• Phishing-resistant MFA (FIDO2) — even if creds are phished, the attacker can't log in.

Human:

• Regular security awareness training and simulated phishing.
• A blameless, easy reporting process ("Report Phish" button) — speed of reporting beats perfection.
• Verify sensitive requests (payments, credential changes) via a second channel.

The Defender's Mindset¶

Assume some users will click. Build controls so that one click doesn't equal a breach: MFA, least privilege, segmentation, and fast detection. Resilience over perfection.