Learning Objective	Essential Knowledge
1.1.A Identify common indicators of social engineering tactics.	1.1.A.1 Social engineering attacks employ psychological tactics to manipulate users into revealing sensitive information (elicitation), downloading a malicious file, or clicking on a malicious link. Social engineering can be performed in person but is often done by email, by text message, or through social media messages. 1.1.A.2 Adversaries often use psychological tactics like intimidation and urgency to achieve their goals. Intimidation is when an adversary threatens a target with negative consequences if they don’t comply. Urgency is when an adversary creates reasons why a target should act quickly.
1.1.B Explain how social engineering tactics influence victims to perform a desired action.	1.1.B.1 Social engineering tactics rely on common psychological principles that influence human behavior. 1.1.B.2 Intimidation leverages a natural human aversion to negative consequences. By drawing attention to possible negative consequences, adversaries use fear to incite targets to act. 1.1.B.3 Urgency leverages a natural human response to react quickly to time-sensitive needs. When targets detect a sense of urgency in a message, they feel pressured to respond or act quickly, which can prevent them from taking the time to consider whether an action is reasonable or safe.
1.1.C Describe possible impacts for victims of social engineering attacks.	1.1.C.1 Victims may give an adversary personal information that could lead to impersonation, such as name, phone number, address, workplace, pets’ names, or birthdate. These types of information, and information like them, are often used on websites as challenge questions to verify a user’s identity. 1.1.C.2 Victims may give an adversary secure information like a one-time password (OTP) or authentication login code, which could allow an adversary to log in to a service as the victim. 1.1.C.3 Victims may download malware or click a link that installs malware on their device, steals information from their web browser, or directs them to a website where their login credentials can be captured by an adversary.

英文	中文	拼音
Social engineering	社会工程学	shè huì gōng chéng xué
adversary	对手	duì shǒu
elicitation	套取信息	tào qǔ xìn xī
Intimidation	恐吓	kǒng hè
Urgency	紧迫感	jǐn pò gǎn
impact	影响	yǐng xiǎng
challenge questions	安全问题	ān quán wèn tí
impersonate	冒充	mào chōng
one-time password (OTP)	一次性密码	yí cì xìng mì mǎ
malware	恶意软件	è yì ruǎn jiàn
phishing	钓鱼	diào yú

Learning Objective	Essential Knowledge
1.2.A Identify common signs of a password attack.	1.2.A.1 In an online password attack, adversaries try logging in to a device or service using common passwords, common password patterns, or stolen passwords. 1.2.A.2 Signs of an online password attack include: Many failed attempts to log in over a short duration Login attempts at unusual times Login attempts from unknown devices
1.2.B Explain how adversaries take advantage of weak authentication.	1.2.B.1 Many people use common patterns when creating passwords, such as: Starting a password with one or two words, adding a two-digit number (often signifying a year), and putting a special character at the end Including the names of family or pets in their passwords Including personally significant dates in their passwords 1.2.B.2 Adversaries often construct a dictionary of possible passwords based on personal information gathered about a target (e.g., birthday, anniversary, names of pets and family) and use an automated tool to submit potential passwords.
1.2.C Explain how to make authentication stronger.	1.2.C.1 Users should create passwords that are long, random, and unique. A password manager can be used to generate and store strong passwords, or a user may create long, unique passphrases for their accounts. 1.2.C.2 When creating passwords, users should avoid names, dates, or other personally meaningful words or numbers. 1.2.C.3 When available, users should enable multifactor authentication (MFA), which will require the user to provide extra proof of identity—such as a one-time code—in addition to the password as an extra layer of security.

英文	中文	拼音
password attack	密码攻击	mì mǎ gōng jī
weak	弱	ruò
dictionary	字典	zì diǎn
authentication	身份验证	shēn fèn yàn zhèng
password manager	密码管理器	mì mǎ guǎn lǐ qì
multifactor authentication (MFA)	多因素身份验证	duō yīn sù shēn fèn yàn zhèng

Learning Objective	Essential Knowledge
1.3.A Identify the type of adversary conducting a cyberattack.	1.3.A.1 Adversaries can be classified by their skill levels. Low-skilled adversaries rely on malicious cyber tools created by others that can be purchased online. The tools they use exploit known vulnerabilities. High-skilled adversaries have the capacity to create new malicious cyber tools or modify existing ones to adapt to new defensive techniques and tools. They also have the capacity to discover undocumented vulnerabilities, known as zero days. 1.3.A.2 Adversaries have a variety of motivations, including greed, desire for recognition, dedication to a cause, revenge, politics, or beliefs.
1.3.B Identify types of wireless cyberattacks.	1.3.B.1 In an evil twin attack, an adversary sets up their own wireless access point (WAP) with a service set identifier (SSID) similar or identical to a target network; the adversary’s network is called the evil twin. Victims of this attack could select to unknowingly connect to the evil twin, allowing the adversary to capture their network traffic. The adversary cannot read traffic that uses an encrypted protocol like HTTPS. 1.3.B.2 In a jamming attack, an adversary floods an area with a strong electromagnetic (EM) signal in the same frequency range as the wireless network, which prevents legitimate traffic between the access point (AP) and users. This type of attack that prevents users from accessing resources is called a denial of service (DoS) attack. 1.3.B.3 In a war driving attack, adversaries try to detect wireless network beacons while driving or walking around a target. If a wireless signal is detected, the adversary can gather information about the type of wireless network used and find areas where the wireless signal extends outside the physical building.
1.3.C Describe actions individuals can take to increase protection of sensitive data when using the internet and Wi-Fi.	1.3.C.1 Individuals should verify that the name of any wireless network they join exactly matches the name of the network they intend to join. 1.3.C.2 Most internet protocols are encrypted to protect network traffic. However, individuals may consider the sensitivity of their data in choosing whether to join unencrypted Wi-Fi networks to protect vulnerable data such as DNS queries. 1.3.C.3 Individuals may consider using a virtual private network (VPN), which encrypts all their traffic to the VPN operator’s system. Although this action prevents a service provider from viewing traffic, the VPN provider can view the traffic.

英文	中文	拼音
exploits	漏洞利用	lòu dòng lì yòng
zero days	零日漏洞	líng rì lòu dòng
motivation	动机	dòng jī
Evil twin	双胞胎恶意热点	shuāng bāo tāi è yì rè diǎn
access point	接入点	jiē rù diǎn
SSID	服务集标识符	fú wù jí biāo shí fú
encrypted	加密的	jiā mì de
Jamming	干扰攻击	gān rǎo gōng jī
denial of service (DoS)	拒绝服务	jù jué fú wù
War driving	战争驾驶	zhàn zhēng jià shǐ
virtual private network (VPN)	虚拟专用网络	xū nǐ zhuān yòng wǎng luò

英文	中文	拼音
deepfake	深度伪造	shēn dù wěi zào
Large language models (LLMs)	大语言模型	dà yǔ yán mó xíng
shared secret	共享秘密	gòng xiǎng mì mì

理解社会工程学

Which social-engineering tactic is it?

可疑的网站登录

公共网络的最佳实践

基于AI的网络安全攻击

在网络防御中运用AI

考试技巧

本主题的互动课程

AP 网络安全的更多主题