CompTIA A+ Certification All-in-One Exam Guide

Not all unauthorized access is malicious—often this problem arises when
users who are poking around in a computer out of curiosity or boredom
discover they can access resources in a fashion the primary user did not have
in mind. Unauthorized access becomes malicious when people knowingly
and intentionally take advantage of weaknesses in your security to gain
information, use resources, or destroy data!
One way to gain unauthorized access is intrusion. You might imagine
someone kicking in a door and hacking into a computer, but more often than
not it’s someone sitting at a home computer, trying various passwords over
the Internet. Not quite as glamorous, but it’ll do.
Dumpster diving is the generic term for searching refuse for information.
This is also a form of intrusion. The amount of sensitive information that
makes it into any organization’s trash bin boggles the mind! Years ago, I
worked with an IT security guru who gave me and a few other IT people a
tour of our office’s trash. In one 20-minute tour of the personal wastebaskets
of one office area, we had enough information to access the network easily,
as well as to seriously embarrass more than a few people. When it comes to
getting information, the trash is the place to look!
Shoulder surfing is another technique for gaining unauthorized access.
Shoulder surfing is simply observing someone’s screen or keyboard to get
information, often passwords. As the name implies, it usually requires the
bad guy looking over your shoulder to see what you are doing.
Social Engineering
Although you’re more likely to lose data through accidents, the acts of
malicious users get the headlines. Most of these attacks come under the
heading of social engineering—the process of using or manipulating people
inside the organization to gain access to its network or facilities—which
covers the many ways humans can use other humans to gain unauthorized
information. This information may be a network login, a credit card number,
company customer data—almost anything you might imagine that one person
or organization may not want outsiders to access.
Social engineering attacks aren’t hacking—at least in the classic sense of
the word—but the goals are the same. Let’s look at a few of the more classic
types of social engineering attacks.