What is one-click fraud?

An online scam where clicking a link makes it look as if you agreed to a contract or subscription, then you are asked to pay a large amount.

When an attacker builds a fake site and sends messages that look like they come from a bank or trusted body, to trick you into entering personal details such as a PIN.

What is social engineering?

A trick that obtains secret information by deceiving people psychologically rather than hacking devices: impersonation, shoulder surfing and dumpster diving.

What is an information security policy?

A set of rules and instructions an organization sets to protect its data from theft, intrusion, change and loss, with three parts: the basic policy, security standards and implementation procedures.

Unit 3 · Lesson 3

Threats and countermeasures (3)

6 steps. Each one is a short story and a question to answer.

Some people try to harm you, and there are ways to protect yourself. This lesson is about both.

Threats: any risk or attack that steals information, damages it or disables systems.

Like: unauthorized access, cracking, malware and cybercrime.

And countermeasures are the ways to protect: antivirus, strong passwords, authentication, backups and firewalls.

Threats

Unauthorized access

Cracking

Malware

Cybercrime

Countermeasures

Antivirus

Strong passwords, authentication

Backups and updates

Firewall

Threat = a danger to your information. Countermeasure = a way to protect it

Using a firewall is...

Pick an answer

A message arrives: "pay for your program subscription", and you never subscribed!

Fraudulent billing: a scammer sends a fake invoice for a service or product you never used, to get your money.

One-click fraud: you click a link and it appears you agreed to a contract, then they demand e.g. 500 EGP within 24 hours.

Protection: don't click unknown links, verify the invoice's source, ignore suspicious messages and never enter personal data.

Fraudulent billing

Fake invoice for an unrequested service

Meant to get money

One-click fraud

A click on a link

Looks like you agreed to a contract

Then demand a big payment

An invoice for a service you never used, or a link that signs you up by force = fraud

A message says to pay 500 EGP within 24 hours after you clicked a link. What do you do?

Pick an answer

A message says: "your bank account was suspended, click here to confirm your data". The page looks exactly like the bank's.

That is phishing: a fake site and messages that look trusted, to make you enter your PIN or account details.

Social engineering tricks you psychologically instead of hacking your device, using trust, fear and curiosity.

It has 3 methods: impersonation, shoulder surfing over your screen or keyboard, and dumpster diving.

Getting data illegally

PhishingFake bank site

Impersonation"I'm from the bank"

Shoulder surfingBehind you at the ATM

Dumpster divingUnshredded papers

Phishing = fake sites and messages. Social engineering = psychological tricks: impersonation, shoulder surfing, dumpster diving

Someone stands behind you watching you type your PIN at an ATM. This is called?

Pick an answer

You withdrew cash at a normal-looking ATM. Later you find purchases you never made!

Skimming is illegally stealing bank card data and using it for a fake card or withdrawals and purchases without your knowledge.

The criminal secretly fits a small device called a skimmer on the ATM or payment device to copy the card data.

He may add a tiny camera or a fake keypad to learn your PIN, then makes a forged card.

A normal ATM

Hidden skimmerCopies data

Tiny cameraSees the PIN

Forged cardWithdrawals, purchases

Skimming = a hidden device copies your card data and PIN

The small device fitted on an ATM to copy card data is called a...

Pick an answer

A big company has hundreds of employees. How does each one know how to handle information safely?

An information security policy is a set of rules an organization sets to protect its data from theft, intrusion, change and loss.

It has 3 parts: the basic policy (principles and goals) and security standards (encryption, strong passwords, permissions).

The third is implementation procedures: practical steps like reporting a break-in attempt and how to back up.

Security policy

Basic policyPrinciples, goals

Security standardsEncryption, permissions

ProceduresPractical steps

Security policy = basic policy + security standards + implementation procedures

Steps for reporting a break-in attempt belong to which part?

Pick an answer

So why exactly does an organization set this policy?

First: protect the organization's data. Second: reduce risks and cyber attacks.

Third: organize how systems and devices are used.

Fourth: preserve the confidentiality and integrity of information.

Protect the organization's data

Reduce risks and attacks

Organize use of systems and devices

Confidentiality and integrity

Protect data + reduce risk + organize use + confidentiality and integrity

Which of these is a goal of a security policy?

Pick an answer

Done, see the summary

Threats and countermeasures (3)

Scroll down ↓ to continue

The lesson on one page

Every idea in the lesson with its rule, ready to screenshot and revise from.

Threats and countermeasures
Threat = a danger to your information. Countermeasure = a way to protect it
Fraudulent billing and one-click fraud
An invoice for a service you never used, or a link that signs you up by force = fraud
Phishing and social engineering
Phishing = fake sites and messages. Social engineering = psychological tricks: impersonation, shoulder surfing, dumpster diving
Skimming
Skimming = a hidden device copies your card data and PIN
Information security policy
Security policy = basic policy + security standards + implementation procedures
Goals of a security policy
Protect data + reduce risk + organize use + confidentiality and integrity

Test yourself

One question from every step. Answer and see your score.

Question 1 of 6

Using a firewall is...

Watch and listen

Quick reel

Unit 3

Learn fraudulent billing and one-click fraud, phishing, social engineering, skimming and information security policies, and how to protect yourself, in an animated explainer.

Share this lessonWhatsApp

The lesson in writing

The same explanation as the 3D scene, written out for quick review.

Threats and countermeasures

Threat = a danger to your information. Countermeasure = a way to protect it. Threats: any risk or attack that steals information, damages it or disables systems. Like: unauthorized access, cracking, malware and cybercrime.

Page 74

Fraudulent billing and one-click fraud

An invoice for a service you never used, or a link that signs you up by force = fraud. Fraudulent billing: a scammer sends a fake invoice for a service or product you never used, to get your money. One-click fraud: you click a link and it appears you agreed to a contract, then they demand e.g. 500 EGP within 24 hours.

Page 74

Phishing and social engineering

Phishing = fake sites and messages. Social engineering = psychological tricks: impersonation, shoulder surfing, dumpster diving. That is phishing: a fake site and messages that look trusted, to make you enter your PIN or account details. Social engineering tricks you psychologically instead of hacking your device, using trust, fear and curiosity.

Page 75

Skimming

Skimming = a hidden device copies your card data and PIN. Skimming is illegally stealing bank card data and using it for a fake card or withdrawals and purchases without your knowledge. The criminal secretly fits a small device called a skimmer on the ATM or payment device to copy the card data.

Page 76

Information security policy

Security policy = basic policy + security standards + implementation procedures. An information security policy is a set of rules an organization sets to protect its data from theft, intrusion, change and loss. It has 3 parts: the basic policy (principles and goals) and security standards (encryption, strong passwords, permissions).

Page 76, 77

Goals of a security policy

Protect data + reduce risk + organize use + confidentiality and integrity. First: protect the organization's data. Second: reduce risks and cyber attacks. Third: organize how systems and devices are used.

Page 77, 78

Questions about this lesson

What is one-click fraud?: An online scam where clicking a link makes it look as if you agreed to a contract or subscription, then you are asked to pay a large amount.
What is phishing?: When an attacker builds a fake site and sends messages that look like they come from a bank or trusted body, to trick you into entering personal details such as a PIN.
What is social engineering?: A trick that obtains secret information by deceiving people psychologically rather than hacking devices: impersonation, shoulder surfing and dumpster diving.
What is an information security policy?: A set of rules and instructions an organization sets to protect its data from theft, intrusion, change and loss, with three parts: the basic policy, security standards and implementation procedures.