GIAC Foundational Cybersecurity Technologies Practice Test

What is Spear Phishing?

1. A phishing attack but you have a specific target in mind for the attack

2. Where you go phishing but with a spear instead of a normal bait and hook

3. Where you target a specific attacker with an email or file in hopes they tag it

4. None of the above

The correct answer is: A phishing attack but you have a specific target in mind for the attack

Spear phishing is a targeted attempt to steal sensitive information such as account credentials or financial information from a specific individual, often for malicious reasons, by masquerading as a trustworthy entity in electronic communications. In this context, identifying a specific target is crucial; the attacker tailors their approach to deceive the chosen individual, using personal information about them to make the phishing attempt appear more legitimate. This could include referencing shared connections, recent activities, or interests that the victim may have, thus increasing the chances of success. The focus on a specific target is what distinguishes spear phishing from traditional phishing, which typically casts a wider net, trying to deceive as many people as possible without targeting any particular individual. Understanding this distinction is vital in recognizing how spear phishing can be particularly dangerous and effective in cybersecurity threats, as it often relies on social engineering tactics to convince individuals to reveal sensitive information.