A. Memo of Case

Social engineering is a method of gaining access to information by deception performed against human capital. System penetrators and ‘crackers’ know that people, and their desire to be helpful, or their ability to emote, are the weakest links in any program designed to protect information systems. Attackers can trick or persuade their way into systems in any number of ways via remote and physical means, and convince users to reveal information of interest that can cause harm to an organization. A typical social engineering attack can be segmented into physical and psychological stages. The physical segment of the social engineering operation could include phone calls, or returned phone calls from employees back to the attacker (an example of reverse social engineering) that volunteer information, ‘dumpster diving’ for company specific information that can be used to simulate a rapport or relationship with the company if questioned by an employee or security, emails with surreptitious links requesting unique information such as PIN’s or user names, or physical proximity and entry by impersonating an authorized person. The psychological stage of a social engineering attack takes place after the physical foot printing of the organization by using the bona fides that were learned while gathering physical intelligence to manufacture relationships with persons or the company, or by asserting false authority by impersonating persons or departments within the company. Employees are lulled into complying because they assume that the person is who they say they are, or represents whom they say they do. (Jones, C. (2003))

In the presented scenario, a supervisor that works in customer care receives an email to his internal email address, which is not publicly accessible, regarding a product listing on the company website. The URL (Uniform Resource