SANS Assessment of Student Learning Plan (ASLP) Security Awareness Training

Phishing is categorized as what type of attack?

1. Technical attack

2. Social engineering

3. Network attack

4. Physical attack

The correct answer is: Social engineering

Phishing is categorized as a social engineering attack because it primarily exploits human psychology rather than technical vulnerabilities. The essence of phishing lies in tricking individuals into divulging sensitive information such as usernames, passwords, or financial details, often through deceptive emails or websites that appear legitimate. Social engineering attacks focus on manipulating individuals into making mistakes or breaching protocol out of trust or fear, which is the core strategy employed in phishing. This differs from technical attacks, which would involve hacking into systems or networks through exploiting software vulnerabilities. Network attacks generally pertain to direct intrusions into networked systems, while physical attacks involve tangible threats to an individual or physical property in a specific location. Phishing, thus, fits squarely within the realm of social engineering due to its reliance on misdirection and psychological manipulation rather than physical or purely technical means.