DIS Social Engineering and Phishing Emails

Social Engineering and Phishing Emails

With your IT dept: Derek, Tyler, Cindy, Brian, and Meg

Social Engineering

The tactic of manipulating, influencing, or deceiving a victim in order to gain control over a computer system, or to steal personal and financial information. It uses psychological manipulation to trick users into making security mistakes or giving away sensitive information.

Discuss with those around you:
What emotions could SEs use to achieve this?

Common phishing email #1

Common phishing email #2

Common phishing email #3

Time to Test your knowledge!

Multiple Select

Which of the following subject lines in an email should alert you to possible social engineering? *choose all that contain red flags* Discuss with those around you before answering.

• Immediate password check required

• Billing information is out of date

• Payroll has been delayed

• Your meeting attendees are waiting!

• Dropbox: Document shared with you

Multiple Select

Which emotions do social engineers attempt to use against their targets? *Select all that apply* Discuss with those around you before you reply.

• greed

• curiosity

• urgency

• helpfulness

• fear

Multiple Choice

How do you find the domain in an email address?

• extract the text after the '@' symbol

• extract the text before the @ symbol

• a domain is the @ symbol

• the domain is the full email address

Multiple Select

What are the red flags that indicate this is a phishing email? *more than 1*

• hyperlink to an urgent matter

• generic greeting

• grammar mistakes

• email is addressed to user

Multiple Select

What are the red flags that indicate this is a phishing email? *more than 1*

• log in link provided instead of directing me to their website

• It asks me to download a file

• urgent request

• email domain

• Paypal logo is incorrect

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly can't tell

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Multiple Select

Is this a legitimate or a phishing email?

• I'm confident this is legit

• I honestly don't know

• This is definitely phishing

Social Engineering Tips!

• ​No Geolocation info - don’t post where you are or will be

• Locking Social Media down - block from public

• Password reuse - Different passwords for different accounts

• If you are not sure, ask.  You can always call or reach out to the sender directly or go to a company's website.  Replying to a suspicious email may not be safe.