You work in the office of a large company. You receive a call from a person claiming to be from the Helpdesk. He asks you for your password. What…

The scenario describes an attacker impersonating a trusted entity (the Helpdesk) to deceive an employee into revealing confidential information (a password). This act of psychological manipulation to circumvent security measures is the definition of social engineering. The attacker is exploiting human trust rather than a technical vulnerability. This specific technique, where an attacker creates a fabricated scenario or pretext to gain information, is a classic social engineering method known as pretexting. The goal is to obtain sensitive data or unauthorized access by tricking an unsuspecting individual.

A. Natural threat: This category includes environmental events like floods, earthquakes, or fires, not deliberate human actions of deception.

B. Organizational threat: This is too general. While the attack is a threat to the organization, "social engineering" is the specific name for this type of attack method.

D. Arason: This is likely a misspelling of "Arson," which is the criminal act of setting fire to property and is unrelated to information security deception.

1. Krombholz, K., Hobel, H., Huber, M., & Weippl, E. (2015). Advanced social engineering attacks. Journal of Information Security and Applications, 22, 113-122. In Section 2, "Background," the paper defines social engineering as the "psychological manipulation of people into performing actions or divulging confidential information," directly matching the scenario. (DOI: https://doi.org/10.1016/j.jisa.2014.09.005)

2. Pfleeger, C. P., Pfleeger, S. L., & Margulies, J. (2015). Security in Computing (5th ed.). Prentice Hall. Chapter 1, Section 1.3, "Methods of Defense," discusses social engineering as a significant non-technical attack where an "attacker persuades a victim to do something" by "impersonating someone else," which is precisely what is described in the question.

3. Whitman, M. E., & Mattord, H. J. (2019). Principles of Information Security (6th ed.). Cengage Learning. Chapter 3, "Legal, Ethical, and Professional Issues in Information Security," explicitly defines social engineering and lists pretexting (impersonating someone with authority, like help-desk personnel) as a primary technique. This aligns with the ISO 27001 framework's emphasis on user awareness training (Control A.7.2.2) to counter such threats.