Phishing: The leading tactic leveraged by today’s ransomware hackers, typically delivered in the form of an email, chat, web ad or website designed to impersonate a real system or organization. Often crafted to deliver a sense of urgency and importance, the message within these emails often appears to be from widely used products or companies and can include logos, branding and verbiage copied from the source to appear authentic.
Baiting: Similar to phishing, baiting involves offering something enticing to an end user in exchange for private data. The “bait” comes in many forms, both digital and physical. Such as the live stream of a popular event, or as a branded flash drive with an enticing label like “Executive Salary Summary Q3 2016” that is left out on a desk for an end user to find. Once the bait is taken, malicious software is delivered directly into the victim’s computer.
Quid Pro Quo: Similar to baiting, quid pro quo involves a request for the exchange of private data but for a service. For example, an employee might see an ad for free IT assistance which eventually requests the exchange of login credentials.
Spear Phishing: When a hacker crafts communication specific to a small set of users, such as the accounting department of a target organization. The hacker creates a false sense of trust between themselves and the end user by impersonating a co-worker or a figure of authority within the company, often using the same communication style as the person they are impersonating. For example, a hacker may send a request for employee W2's from the CEO during an audit or another time when the HR department would expect this type of request.
Tailgating: is when an unauthorized person physically follows an employee into a restricted corporate area or system. The most common example of this is when a hacker calls out to an employee to hold a door open for them as they’ve forgotten their RFID card. Another example of tailgating is when a hacker asks an employee to “borrow” a private laptop for a few minutes, during which the criminal is quickly able to steal data or install malicious software.