An intruder posing as the organization's CEO sent an email and tricked payroll staff into providing employees' private tax information. What type of attack was perpetrated?
A spear phishing attack is a highly targeted email-based attack where an attacker impersonates a trusted individual (e.g., the CEO) to trick recipients into providing sensitive information.
In this scenario, an intruder posed as the CEO and deceived payroll staff into sharing employees' private tax information.
Spear phishing is more targeted than general phishing, often using personal details to make the fraudulent request seem legitimate.
A. Boundary attack. (Incorrect)
A boundary attack refers to attempts to breach an organization’s network perimeter defenses, such as firewalls and intrusion detection systems.
This scenario describes a social engineering attack, not a technical boundary attack.
B. Spear phishing attack. (Correct)
Spear phishing attacks are highly personalized email attacks, usually targeting specific employees within an organization.
Attackers research their targets and use realistic messages to trick them into divulging sensitive data.
This fits the scenario, as the attacker impersonated the CEO to steal tax information.
C. Brute force attack. (Incorrect)
A brute force attack involves systematically guessing passwords to gain unauthorized access to systems.
This attack was based on deception, not password cracking.
D. Spoofing attack. (Incorrect, but closely related)
Email spoofing is a technique where an attacker falsifies the sender’s email address.
While spear phishing often includes spoofing, the broader technique used here is spear phishing, as it involved social engineering and deception.
IIA GTAG 16 – Security Risk: IT and Cybersecurity discusses phishing and social engineering threats, emphasizing internal controls to mitigate them.
IIA Standard 2120 – Risk Management highlights the need for risk assessments in cybersecurity, including employee awareness training for phishing attacks.
National Institute of Standards and Technology (NIST) Special Publication 800-61 classifies spear phishing as a high-risk cyber threat to organizations.
Explanation of Answer Choices:IIA References:
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit