A cybersecurity team at a financial institution is investigating a potential phishing attack. The attack involved a fraudulent email sent to…

The scenario describes a classic phishing attack, which is fundamentally a form of social engineering. The attacker uses psychological manipulation by creating a sense of urgency with the subject line "Urgent: Update Your Account Details." They also manipulate trust by impersonating a legitimate entity (the company's intranet) with a look-alike website. The core of this attack is not a technical exploit but rather the deception of human employees to trick them into voluntarily surrendering their credentials. This direct manipulation of human behavior to bypass security controls is the definition of social engineering.

B. SQL Injection on the intranet login page: This is incorrect because SQL Injection is a code injection technique used to attack data-driven applications, not a method for deceiving users to visit a fraudulent website.

C. Exploitation of zero-day vulnerabilities: This is incorrect as the attack described targets human psychology and trust, not an unknown and unpatched software flaw (a zero-day).

D. Distributed Denial of Service (DDoS): This is incorrect because a DDoS attack's goal is to make a network resource unavailable to its intended users, whereas the attack in the scenario aims to steal information.

---

1. National Institute of Standards and Technology (NIST). (2017). NIST Special Publication 800-63-3: Digital Identity Guidelines. Section 5.2.3, "Phishing".

Quote/Paraphrase: This publication defines phishing as "a form of social engineering" where attackers use email and fraudulent websites to solicit personal information, such as credentials, from users. The scenario perfectly matches this official definition.

2. Warner, J. (2011). Understanding Social Engineering Based Scams. Carnegie Mellon University, CyLab. Document Number: CMU/SEI-2011-TN-011.

Quote/Paraphrase: This technical note explains that social engineering attacks, including phishing, rely on creating a pretext (e.g., an urgent need to update an account) and using deception to persuade a target to take a specific action, such as clicking a malicious link.

3. Kirlappos, I., & Sasse, M. A. (2012). Security is a cost-benefit problem: How to persuade users to invest in security. In Proceedings of the Eighth Symposium on Usable Privacy and Security (SOUPS '12). Association for Computing Machinery, New York, NY, USA, Article 11, 1–14. https://doi.org/10.1145/2335356.2335370

Quote/Paraphrase: This academic paper discusses the psychological principles behind phishing, noting that attackers exploit heuristics like authority and urgency (p. 3, Section 3.1) to make their requests seem legitimate and bypass the user's critical thinking, which is central to the described scenario.