| 🏠 Back to Exam Syllabus | 📺 RooCloud on YouTube | 🌐 RooCloud Practice Exams |
CISSP 2.3 - Social Engineering (Part 3 of 3)
This episode of the ISC2 Certified Information Systems Security Professional (CISSP) exam prep series finishes the social engineering coverage in Domain 1, moving from physical entry tricks at your doors to the large-scale information attacks that reach past individuals into organizations and society — and the habits and policies that close these final blind spots.
What this episode covers
- Tailgating and piggybacking — following someone through a door without knowledge versus tricking them into consenting.
- Baiting and dumpster diving — dropped memory sticks that trigger malware and discarded papers that fuel pretexts.
- Identity theft vs identity fraud — stealing identifying information versus falsely claiming to be someone else for gain.
- Typosquatting, URL hijacking, and clickjacking — web tricks that hijack mistyped addresses and misdirect clicks.
- Influence campaigns — disinformation, misinformation, propaganda, fake news, and doxing that shape public opinion.
- Hybrid warfare — blending traditional conflict with digital and psychological attacks that harm everyone.
- Social media and insider risk — everyday posting as a leak channel, governed by acceptable use policies and filtering.
Watch the full episode above for the worked examples and detailed explanations of each concept.
Frequently Asked Questions
How do attackers slip through your secured doors?
Through tailgating and piggybacking. Tailgating happens when an intruder follows an authorized person through a door without their knowledge, catching it before it locks, while piggybacking tricks the victim into consenting, often by posing as someone with full hands who needs the door held. Ensure doors close and lock behind you, back that up with access control vestibules, cameras, and guards, and never extend the courtesy of an open door at a secure entrance.
What secrets do bait and trash reveal?
More than you would expect. Baiting drops tempting items like memory sticks or discs where a worker will find them, hoping curiosity leads them to plug it into a work computer and trigger malware, while dumpster diving digs through discarded papers, equipment, and media for anything useful as fuel for a convincing pretext. Defend both by shredding or incinerating documents, never trashing storage media, and teaching staff to distrust found devices.
How do identity theft and identity fraud work?
They are related but distinct. Identity theft is the act of stealing someone’s identifying information, such as usernames, passwords, or financial details, and also describes using those stolen credentials to take over an account, which is credential hijacking. Identity fraud is falsely claiming to be someone else for personal or financial gain, and both are forms of spoofing, hiding a real identity behind a false one.
What are influence campaigns, and what forms do they take?
Influence campaigns are coordinated efforts to shape public opinion, usually by spreading false or misleading content. Their tactics include disinformation, falsehood spread deliberately to manipulate; misinformation, inaccurate content shared without malicious intent; propaganda, which pushes biased ideas to promote a cause; fabricated fake news dressed as real journalism; and doxing, which publishes someone’s private information to harass or shame them. In the digital age these campaigns spread instantly and cheaply, and some of the people running them are domestic, not foreign.
What is hybrid warfare, and why should you care?
Hybrid warfare is the blending of traditional conflict with digital and psychological attacks, combining military strategy with social engineering, influence campaigns, psychological pressure, and cyber operations. The harm reaches everyone, not just soldiers, damaging reputation, finances, digital infrastructure, and relationships. The practical takeaway is skepticism: do not assume anything you see online is accurate, valid, or complete, even when it comes from people you trust.
📚 Master the ISC2 CISSP Exam!
Ready to test your knowledge? Access chapter-specific Multiple Choice Questions (MCQs) and full-length practice exams for the ISC2 CISSP certification at RooCloud.com. Solve the chapter-wise questions to reinforce this lesson before moving to the next episode.
Reference: This article is based on concepts discussed in CISSP 2.3 - Social Engineering (Part 3 of 3).