Phishing and authentication
Recognise deceptive requests and explain how controls reduce specific risks.
What you will learn
- Identify a phishing attempt.
- Distinguish social engineering from technical access controls.
The target is a decision
Phishing uses a deceptive message or site to persuade someone to disclose information, open a malicious attachment or take another harmful action. A fake login page can look convincing because visual branding can be copied.
Urgency, an unexpected request and a mismatch between a claimed organisation and the actual destination are clues. A padlock indicates an encrypted connection; it does not prove the site is the genuine organisation.
Match the control to the threat
Independent verification through a known channel reduces reliance on a message's claims. Multi-factor authentication can reduce the damage from a stolen password, but it is not a guarantee against every phishing method.
In an exam explanation, name the threat, describe how it works and connect the proposed control to the part of the attack it limits. Avoid saying a control makes a system completely secure.
Worked example
A message claims that a bank account will close unless the user signs in through its link. The page copies the bank's design. Identify and explain the threat.
Show the worked solution
- The message pressures the user to act urgently.
- It directs them to a login page whose authenticity is not established.
- The likely purpose is to collect credentials through deception.
Answer Phishing, a form of social engineering
Common mistakes
- An encrypted connection can still lead to a fraudulent site.
- Phishing is not the same as guessing many passwords by brute force.
What can you explain now?
Does knowing a password alone satisfy two-factor authentication?
Compare with the explanation
No
Two-factor authentication combines different categories of evidence, such as knowledge and possession.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.