Cyberstudy
PDF p.42 In progress

Human Vectors

Open PDF at p.42 11 flashcards

Summary

PDF p.42

Human vectors involve exploiting the people operating computers and accounts within an organization. Social engineering techniques are used to elicit information or persuade individuals to perform actions that benefit the threat actor.

In plain words

Supplementary — not from your PDF

Social engineering targets people instead of computers. Attackers trick staff into revealing information or doing something useful for them, which is why it's called 'hacking the human'.

Detailed explanation

PDF p.42
  • Human Vectors
    • Definition: Part of the attack surface involving employees and contractors.
    • Knowledge: Stored in the minds of people, not just on computer disks.
  • Social Engineering
    • Definition: Techniques to elicit information or get someone to perform an action.
    • Purpose: Gather intelligence for reconnaissance or effect an intrusion.
    • Also Known As: "Hacking the human."
  • Social Engineering Scenarios
    • Executable File
      • Method: Creates a file prompting for a password, records input.
      • Example: Emails the file with a story about login problems, gains network credentials.
    • Help Desk Call
      • Method: Pretends to be a remote sales representative needing assistance.
      • Example: Obtains remote access server details, login credentials, and phone numbers.
    • Fire Alarm
      • Method: Triggers an alarm, slips into the building during confusion.
      • Example: Attaches a monitoring device to a network port.

Important terms

taken from the text above
Human Vectors
Part of the attack surface involving employees and contractors.
Knowledge
Stored in the minds of people, not just on computer disks.
Social Engineering
Techniques to elicit information or get someone to perform an action.
Also Known As
"Hacking the human."

Examples & real-world scenarios

Supplementary — not from your PDF
  • A phone call pretending to be a remote worker locked out of their account.
  • An email with a fake login prompt.
  • Slipping into a building during a fire-alarm evacuation.

Scenario

A help-desk agent resets a password for a caller who sounds stressed and knows the manager's name. Requiring identity verification through a known channel stops this, even for convincing callers.

Common mistakes

Supplementary — not from your PDF
  • Thinking technical controls alone stop social engineering.
  • Believing only careless people fall for it. Good pretexts fool experienced staff too.

Practical skills

Supplementary — not from your PDF
  • Spot the social engineering technique in a short story or transcript.

What I should remember

Key Points PDF p.42
  • Human Vectors
    • Definition: Exploiting people within an organization.
    • Knowledge: Exists in employees' and contractors' minds.
  • Social Engineering
    • Definition: Eliciting information or persuading actions.
    • Purpose: Intelligence gathering, intrusion.
    • Also Known As: "Hacking the human."
  • Social Engineering Scenarios
    • Executable File: Prompts for password, records input.
    • Help Desk Call: Pretends to be a remote worker, gains access details.
    • Fire Alarm: Creates confusion, attaches monitoring device.