Which of the following is an example of social engineering?

Social engineering is a non-technical intrusion technique that relies on human interaction and psychological manipulation. It involves tricking people into breaking normal security procedures or divulging confidential information. Asking a user to disclose their password over the phone is a classic example of pretexting, a social engineering tactic where an attacker creates a fabricated scenario (e.g., pretending to be IT support) to gain the victim's trust and persuade them to provide sensitive data like a password.

A. Antivirus software is a technical security control designed to detect and remove malicious software; it is a defense against attacks, not an attack itself.

B. Updating the operating system is a fundamental technical security practice (patch management) to fix known vulnerabilities and protect against exploits.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63-3: Digital Identity Guidelines. https://doi.org/10.6028/NIST.SP.800-63-3 (Section 5.2.2 discusses social engineering as a primary threat to authentication processes, including phishing and pretexting).

2. Krombholz, K., Hobel, H., Huber, M., & Weippl, E. (2015). Advanced social engineering attacks. Journal of Information Security and Applications, 22, 113-122. https://doi.org/10.1016/j.jisa.2014.09.005 (Defines social engineering as "the art of manipulating people into performing actions or divulging confidential information").

3. Stanford University. (n.d.). Social Engineering. IT Protects - Stanford University Information Security Office. (Defines social engineering and provides examples such as phishing, baiting, and pretexting, which includes eliciting information over the phone).