Social Engineering

An attacker uses social skills to obtain or compromise information on an individual or an organization and its computer system. Types of social engineering include:

• Phishing. Uses email or malicious websites to get personal information by posing as a trustworthy organization. For example, they may say they are from a financial institution requesting account information and suggests there is a problem. Attackers may appear from other organizations such as charities. They take advantage of current events and certain times of year such as natural disasters, epidemics, economic concerns, tax season, major political elections, and holidays
• Vishing. Uses voice communication. Often entices a victim to call a certain number and divulge sensitive information.
• Smishing. Uses SMS or text messages to contain links to webpages, email addresses, or phone numbers. When clicked it may automatically open a browser window, email message, or dial a number.
• Pharming. When malicious code is installed on your computer to redirect you to fake websites.

Malware

Intrusive software designed to damage and destroy computer systems. Malware includes:

• Adware. Used to collect data on your computer usage and provide appropriate advertisements to you. While it is not always dangerous, in some cases it can cause issues, such as redirecting a browser to unsafe sites and can slow down your system noticeably.
• Ransomware. Gains access to sensitive information within a system, encrypts it so a user cannot access it, and then demands a financial payout for the data to be released. Commonly part of a phishing scam.
• Spyware. Runs secretly on a computer and reports back to a remote user. Often used to steal financial or personal information.
• Trojan virus. Disguised as helpful software programs. Once it is downloaded, the Trojan virus gains access to sensitive data and then modifies, block, or delete data. Not designed to self-replicate like viruses or worms.
• Viruses. A piece of code attached to a document, file, app, or text message attachment to execute its code from host to host. Once downloaded and opened, they disrupt a system’s ability to operate such as enabling frequent pop-up windows, changing your homepage, an unusually slow processing.
• Worms. Rapidly replicate and spreads to any device within a network. It does not need a host program to spread. It infects a device via a downloaded file or network connection before it multiplies and spreads.

Business Email Compromise/Email Account Compromise

One of the most financially damaging online crimes involves unauthorized access to email accounts. Criminals send a message that appears to come from a known source making a legitimate request. A scammer might:

• Spoof an email account or website. There will be slight variations on legitimate addresses, such as john.kelly@company.com vs. john.kelley@company.com.
• Send spearphishing emails. These messages look like they are from a trusted sender and trick victims into revealing confidential information.
• Use malware. Malicious software infiltrates company networks to get access to legitimate email thread on billing and invoices.

Distributed Denial-Of-Service

Legitimate users are unable to access information systems, devices, or other network resources. Services affected may include email, websites, online accounts, or other services. It’s accomplished by flooding the targeted host with traffic until the target cannot respond or simply crashes.

Hacking

When an unauthorized user attempts or gains access to an information system. This is often used to compromise digital devices, such as computers, smartphones, tablets, and entire networks.

Additional Resources

• Internet and online safety for kids
• Wisconsin Dept. of Agriculture, Trade and Consumer Protection Identity Theft Information
• Wisconsin Statewide Intelligence Center
• Southeastern Wisconsin Threat Analysis Center
• Federal Trade Commission Identity Theft
• FBI CYBER THREATS
• Cybersecurity & Infrastructure Security Agency
• Preparing for a Cyber Incident