4.2 Summarize various types of attacks and their impact
Social Engineering
📘CompTIA Network+ (N10-009)
1. What is Phishing?
Phishing is a type of social engineering attack. Social engineering is when attackers try to trick people into doing something that compromises security, like giving away passwords, clicking on malicious links, or installing malware.
Phishing specifically involves deceptive messages that appear to come from a trustworthy source, such as:
- An email that looks like it’s from your company’s IT department
- A message from a “bank” or “service provider” asking you to update credentials
- Fake internal notifications, like password expiration warnings
The attacker’s goal is usually to steal sensitive information or gain unauthorized access to systems.
2. Common Types of Phishing in IT Environments
- Email Phishing
- The most common type.
- The attacker sends an email pretending to be someone you trust (IT admin, HR, cloud service provider).
- The email may contain:
- A link to a fake login page (to steal username/password).
- An attachment with malware (like ransomware).
- Example scenario: An employee receives an email asking them to reset their network password. They click the link, which leads to a fake login page. The attacker captures their credentials.
- Spear Phishing
- Targeted phishing aimed at a specific individual or group.
- Uses personal information to appear more legitimate.
- Example: An attacker knows a team uses a specific cloud service. They send a fake notification about a “new file” in that service to that team only.
- Whaling
- Phishing targeting high-level executives (CIO, CEO, CFO).
- Often involves fake financial requests or HR messages.
- High risk because executives have access to sensitive data or systems.
- Vishing (Voice Phishing)
- Phishing over phone calls.
- Attackers may pretend to be IT support asking for login info or MFA codes.
- Smishing (SMS Phishing)
- Phishing via text messages.
- Often contains a malicious link to a fake login page or malware download.
3. How Phishing Works Technically
- Fake Website/Link: The attacker creates a website that looks exactly like a legitimate login portal.
- Malicious Attachments: Documents or files that execute malware when opened.
- Credential Harvesting: When a user enters credentials on a fake login page, the attacker collects them.
- Exploitation: Once the attacker has credentials, they can access company systems, emails, cloud storage, or sensitive data.
4. How to Recognize Phishing Attempts
Key signs include:
- Unexpected email: From IT, bank, or vendor you weren’t expecting to hear from.
- Urgency or Threats: “Your account will be locked unless you act now.”
- Suspicious Links: Check the actual URL by hovering over links. Often slightly misspelled domains.
- Attachments: Unexpected files, especially with macros or executables.
- Requests for Sensitive Information: Legitimate IT staff or vendors never ask for passwords via email.
5. Phishing Prevention in IT Environments
- User Education and Training
- Teach staff to recognize suspicious emails, links, and attachments.
- Email Filtering and Security Solutions
- Anti-phishing and anti-spam filters.
- Look for SPF, DKIM, DMARC checks to verify sender authenticity.
- Multi-Factor Authentication (MFA)
- Even if credentials are stolen, MFA can block access to systems.
- Regular Patching and Updates
- Prevent attackers from exploiting vulnerabilities after a phishing-induced malware download.
- Simulated Phishing Tests
- IT teams send fake phishing emails to employees to test awareness and improve security.
6. Exam Tips
- Know the difference between:
- Phishing: General attempt to steal info via email/links.
- Spear Phishing: Targeted, using personal info.
- Whaling: Targeting executives.
- Vishing / Smishing: Voice or SMS versions.
- Remember prevention strategies:
- User education
- MFA
- Email filtering
- Be familiar with the goal of phishing: steal credentials or deploy malware.
✅ Summary for Students:
Phishing is all about tricking people into giving up sensitive information through fake messages, links, or attachments. IT environments prevent phishing by educating users, filtering emails, enforcing MFA, and testing staff awareness. Knowing the types and signs is crucial for both exam and real-world security.
