L30
Social engineering and password attacks
Cram this first — memory hook
Pressure + secret request = pause and verify. Look over shoulder, follow through door, search the bin: three physical information/access paths.
Exam trap
Good spelling, an internal-looking name or a caller who knows your student number does not prove legitimacy.
The slide facts
Social engineering includes phishing, shoulder surfing, tailgating/piggybacking and dumpster diving. The companion slides distinguish dictionary and brute-force password attacks.
If you have time — extra
Social engineering manipulates a person into granting information or access. Phishing uses deceptive messages/sites; shoulder surfing observes sensitive input; tailgating slips through controlled entry; piggybacking is often used for entry with another person's assistance. Course usage can vary for the last pair, but every entrant should be properly authorized. Dumpster diving searches discarded material for useful secrets. A dictionary attack tries likely words or known passwords; brute force systematically tries combinations. Password guessing against a login service differs from offline guessing against stolen password hashes. Multi-Factor Authentication () can reduce password-only compromise, but users can still be tricked into approving requests or revealing One-Time Passwords (OTPs). Independent verification means contacting the purported sender through an already trusted channel, not calling the number in the suspicious message.
Walkthrough
Pause when a request uses urgency, authority or secrecy; avoid disclosing secrets; verify through known channels; follow the reporting process; preserve the suspicious message where appropriate.