Skip to content

Chapter 2 of 7

Social Engineering and Password Attacks

People are often the weakest link in any security system, and attackers exploit this through social engineering—the manipulation of human psychology to trick individuals into revealing confidential information or performing unsafe actions. Many variants target specific channels. Phishing uses fraudulent email or messages to steal credentials or install malware. Spear phishing narrows the focus to a specific individual or group, while whaling goes further by targeting senior executives, who are referred to as the "big fish." Voice phishing, called vishing, is conducted over the telephone or VoIP, and smishing delivers the same trick through SMS text messages. Pretexting fabricates a believable scenario, such as posing as IT support, to persuade victims to share data. Outside the digital realm, tailgating (also called piggybacking) occurs when an unauthorized person physically follows an authorized employee through a controlled door, and dumpster diving recovers sensitive information from discarded trash, such as printed documents or written-down credentials.

When social engineering fails or is unnecessary, attackers turn to technical password attacks. A brute-force attack tries every possible password combination until the correct one is found, while a dictionary attack narrows the search to a predefined list of common passwords. Credential stuffing uses username and password pairs leaked from one breach to attempt logins on unrelated services, exploiting password reuse across sites. Password spraying works in the opposite direction: rather than hammering one account with many passwords, it tries a small set of common passwords across many accounts to avoid triggering account lockouts. These attacks succeed because users often choose weak or reused passwords and because many organizations still rely solely on knowledge-based authentication.

Defending against these attacks requires strong password storage practices. Hashing is a one-way cryptographic function that maps data of any size to a fixed-size output called a digest. Unlike encryption, hashing is not reversible—given a hash, you cannot recover the original input. This one-way property is what makes hashing suitable for storing passwords. However, attackers can still recover weak passwords using precomputed rainbow tables, large databases of hashes for common passwords. The standard defense is salting: appending a unique random value to each password before hashing so that precomputed tables become ineffective. With proper salting and a modern, deliberately slow hash function, even leaked password databases resist practical cracking.

All chapters
  1. 1Security Principles and Risk Management
  2. 2Social Engineering and Password Attacks
  3. 3Cryptography and PKI
  4. 4Network Security and Secure Communications
  5. 5Identity, Authentication, and Access Control
  6. 6Wireless Security and Denial of Service
  7. 7Security Monitoring and Operations

Drill it

Reading is not remembering. These come from the Comptia Security Plus Sy0 deck:

Q

What does the CIA triad stand for in information security?

Confidentiality, Integrity, and Availability

Q

Which security principle extends CIA by adding authentication, authorization, and accounting (non-repudiation)?

AAA (Authentication, Authorization, Accounting)

Q

What is the difference between authentication and authorization?

Authentication verifies identity ("who you are"); authorization determines permitted actions ("what you can do")

Q

Define non-repudiation.

Assurance that a party cannot deny having performed an action, typically via digital signatures or audit logs