In a vishing attempt, attackers use phone calls to trick individuals into divulging sensitive information or granting access to secure systems. The correct response to such a request is to verify the caller’s identity through independent means. By requesting the caller’s employee ID and then verifying it through the vendor’s official support line (using contact information known to be genuine)

Impersonation in social engineering involves an attacker pretending to be someone they are not, such as an IT staff member, to gain trust and manipulate the target into providing sensitive information or access.

Dumpster diving involves searching through a company’s trash to find sensitive information that can be used in further attacks or for malicious purposes. The best way to mitigate this risk is by ensuring that sensitive documents are properly disposed of, which can be achieved through a clean desk policy and secure document destruction procedures. This might include shredding documents before disposal or using a service that guarantees secure destruction.

Shoulder surfing is a social engineering technique where an attacker directly observes someone’s screen or keypad to gather information. While changing passwords regularly and encrypting data are important security measures, they do not prevent someone from visually acquiring sensitive information off a screen. Using a privacy screen makes it difficult for individuals to view the screen from side angles, significantly reducing the risk of information being seen by unintended viewers.

Phishing attacks often mimic legitimate company communications to steal login credentials or personal information. Employees should be cautious with emails requesting sensitive actions, such as logging in through a link or providing credentials. The best course of action is to verify the request’s authenticity by contacting the supposed sender through a known, official communication method (e.g., an internal phone number or officially listed email) before taking any action.

Dumpster diving is a technique used by attackers to retrieve sensitive information from documents that are not properly disposed of. Shredding documents before disposal is the most direct and effective method to ensure that any sensitive information becomes unreadable and thus useless to potential dumpster divers.

An evil twin attack involves setting up a rogue Wi-Fi network with a name similar to a legitimate network to trick users into connecting and then intercepting their data. While asking for the Wi-Fi network’s name and avoiding public Wi-Fi can reduce risk, these measures do not fully protect data transmission. The use of a VPN encrypts data from the device to the VPN server, safeguarding information even if the employee connects to a malicious network. This policy ensures that all transmitted data is secure, regardless of the network’s legitimacy.

While all the options provided contribute to a secure environment, mantraps are the most effective physical security measure against tailgating because they control access to secure areas by allowing only one person to enter or exit at a time. This mechanism ensures that each individual must authenticate independently, preventing unauthorized persons from following authorized individuals into restricted areas without detection.