Unit 02 of 03
Social Engineering
Measuring the human layer as one link in the chain: the number of verification items at decision time and the budget that time pressure cuts short, the number of distinguishing indicators across phishing types and the cost of threshold choice, the verifiability gap between text messages and voice calls, physical techniques counted in access items, the edit distance and visual similarity used to detect typosquatted domain candidates, watering hole attacks built on a shared external dependency, and the persistence of awareness programs measured on two metrics.
Published Updated
Lessons
- 01 Fundamentals of Social Engineering Modeling the moment of decision as a time budget: how many of seven verification items can be used under pressure, how many of twelve requests are fake and pass anyway, how many of six chain links carry a control, and the requests a callback procedure stops versus the legitimate work it delays. 13 min read
- 02 Phishing Types Counting ten indicator types in a fictional set of twenty-six messages: the gap in average indicator count across bulk, spear, and whaling messages, the opposite directions of what a threshold scan misses versus what it falsely flags, legitimate messages flagged independent of any threshold, and the early-break gain of a five-step chain. 13 min read
- 03 Other Channels Measuring text-message- and voice-call-based phishing in terms of verifiability: the strength of ten verification items across four channels, the fact that the number of strong items in a voice call is zero, the number of breakable links per channel, and the link a callback verification procedure gains in only one channel versus the cost it pays across four channels. 13 min read
- 04 Physical Techniques Counting tailgating, shoulder surfing, and dumpster diving in terms of access items: the number of paths to the target zone in a fictional building made up of ten doors, five cards, and two visual verifications, how many doors break the chain on each path, the two paths that never break, and the ten access items the escort procedure gains against its daily cost of 6.8 hours. 13 min read
- 05 Domain Spoofing Detecting typosquatting and homograph domain names in a fictional registry list: the number of candidates edit distance and visual normalization catch separately and together, each metric's false positive rate, the one spoof that is missed, and the average 11.3-day window that registry monitoring gains. 8 min read
- 06 Watering Hole Attacks Modeling the watering hole attack as a shared dependency: eight external resources that six internal applications reach, how many users a single resource affects at once, at which link the six-step chain breaks per resource, the three chains that a resource-integrity hash breaks, and the 48-day-a-year delay cost of version pinning. 13 min read
- 07 Awareness Programs Running the awareness program with two metrics: the weekly path of the reporting and click rate after training, which week the gain decays back to its old value, the eighteen-fold difference in the number of people who click before the first report, and the per-hour return of four reinforcement intervals. 13 min read