IGCSE ICT YEAR 11 COMPUTER SECURITY: PHISHING

IT Security and Audit

1. PHISHING BY: AG Osuri

2. WHAT IS PHISHING? This a type of cybersecurity attack during which malicious actors send messages pretending to be a trusted person or entity. Phishing message manipulates a user, causing them to perform actions like installing a malicious file or clicking a malicious link.

3. How does Phishing work? The basic element of a phishing attack is a message, sent via email, socialor electronic communication means. A phisher may use public resources e.g. social networks to collect background information about personal and work experience of their victim. They can gather the victim’s: name, job title,email address as well interests and activities. The phisher then sends out and email based on the above and makes it believable to the victim and the attackers might attempt to collect private information like usernames and passwords, or payment information.

4. Email Phishing Most phishing attacks are sent via emails. Attackers typically register fake domain names that mimic real organisations For fake domains they may add or replace characters. Many phishing emails use a sense of urgency or a threat to cause user to comply quiclly without checking authenticity of the email Email phishing may have some of the goals: Causing the user to click a link to a malcious website in order to install malware on their device Causing the user to reply and provide personal data

5. Spear Phishing This include malicious emails sent to specific people. This helps increase the effectiveness of phishing emails and manipulate victims into performing tasks and activities such as transferring money.

6. Whaling Whaling attacks target senior management and other highly privileged roles. The ultimate goal of whaling is the sma as other types of phishing attacks, the technique is often is very subtle. Whaling attackers commonly use bogus tax returns to discover sensitive data about the victim and use it ti craft their attack

7. Smishing and Vishing Smishing involves fraudulent SMS messages while vishing vishing involves phone conversations Vishing an attacker pretends to be a sam investigator for a credit card company or bank informing victims that their account has been breached. The attacker then asks for payment card information to supposedly verify their identity or transfer money to a secure account