A penetration tester is crafting an email to impersonate a senior executive of a large corporation as part of a security assessment. The goal is to manipulate another high-ranking executive into disclosing sensitive company information. Which of the following tactics would be MOST effective for this scenario?
You selected this option
Register a domain name that is a common misspelling of the company’s actual domain to send the email from, in the hopes that it goes unnoticed.
You selected this option
Impersonate a trusted co-worker in a department not usually interacting with the executive to increase the likelihood of the executive responding due to curiosity.
You selected this option
Initiate a generic email phishing campaign with a broad and common theme hoping to catch the executive among other employees.
You selected this option
Craft the content to seem like an urgent issue unique to the company that requires immediate attention, using specific jargon and references known only to the executive team.
Due to the target being high-ranking executives, a highly personalized and strategic approach, such as creating a situation that appears urgent and unique to the company's operations or executive interest, is most effective. This specially crafted approach is known as whaling because it targets the 'big fish' of an organization. Impersonating a trusted co-worker may not be high-level enough for the targeted individual. Likewise, generic email phishing and registering a similar sounding domain name can be components of a whaling attack but lack the personalized and strategic targeting required for a whaling attack to succeed.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What does whaling mean in cybersecurity?
Open an interactive chat with Bash
Why is it important to use specific jargon when communicating with executives?
Open an interactive chat with Bash
What are effective strategies in a phishing attack targeting executives?