Certified: The Security+ Prepcast

In this episode, we are continuing our exploration of human threat vectors and social engineering by focusing on impersonation tactics and information manipulation. Attackers do not always need to break through a firewall or exploit a technical vulnerability to succeed. Sometimes, they only need to appear legitimate, confident, and timely. Social engineering attacks often prey on human trust and institutional confusion—and in many cases, that’s enough to compromise even well-protected environments.
Let’s begin with misinformation and disinformation. These terms are often used interchangeably, but they have distinct meanings in cybersecurity. Misinformation refers to false or misleading information that is shared without malicious intent—usually due to misunderstanding or poor verification. Disinformation, on the other hand, is deliberately false content shared with the intent to deceive, disrupt, or influence outcomes.
Both types of information manipulation can be used in cyberattacks to confuse employees, damage reputations, or spread panic. In organizations, misinformation might cause internal teams to make poor decisions based on false reports. Disinformation can be weaponized to discredit a company during a crisis, sway public opinion, or even reduce consumer trust in a brand or platform.
Attackers may use fake press releases, fraudulent social media posts, or manipulated screenshots to mislead internal teams or external audiences. These tactics are often timed to coincide with real events—like a product recall, an outage, or a legal investigation—making the false information seem plausible.
Defensive strategies include monitoring public and internal channels for anomalies, educating employees about the risk of false information, and preparing communication teams to respond quickly when misinformation spreads. Organizations should also use trusted sources to verify questionable reports and have pre-approved messaging templates ready to counteract false narratives.
Now let’s turn to impersonation attacks. These attacks involve someone pretending to be a trusted individual or organization in order to deceive the victim. Unlike phishing or smishing, which focus on delivery methods, impersonation is about psychological strategy—specifically, exploiting the trust that people place in authority figures, coworkers, or familiar brands.
One common example is Business Email Compromise. In a B E C attack, the attacker poses as a company executive, vendor, or manager and asks the victim to perform an urgent action—like transferring funds, changing payment details, or providing sensitive credentials. These messages often use convincing language and appear to come from legitimate addresses, thanks to domain spoofing or compromised accounts.
Another impersonation tactic is pretexting. In this approach, the attacker creates a fabricated scenario to obtain sensitive information. They might claim to be a new I T employee requesting remote access, or an auditor verifying employee records. By using believable details and professional tone, they lure the target into providing data or access.
Watering hole attacks are another subtle impersonation method. In this scenario, the attacker identifies a website frequently visited by the target group—such as an industry news site or vendor portal—and infects it with malware. When a user visits the compromised site, their system is infected without them realizing it. The trust placed in the legitimate site becomes the attacker's weapon.
Preventing impersonation attacks requires a mix of technical and human defenses. Email filtering tools should flag suspicious sender names, detect unusual request patterns, and block spoofed domains. Employees should be trained to verify unusual requests—even those that appear to come from within the organization—through separate communication channels. Multi-step approval processes for sensitive actions, like wire transfers or password resets, are also highly effective.
Let’s now explore brand impersonation and typosquatting. These are forms of deception where attackers mimic trusted brands or websites to trick users into handing over information or credentials. In brand impersonation, attackers might send fake emails that appear to come from a bank, delivery service, or software provider. The emails contain logos, colors, and tone that closely match the real brand, increasing the likelihood of success.
Typosquatting takes advantage of typing errors. Attackers register domains that are one or two characters off from legitimate ones—such as “micros0ft dot com” or “paypaI dot com.” These fake domains may host phishing sites, malicious downloads, or redirect users to harmful content. Victims often don’t notice the slight differences in spelling until after they’ve submitted sensitive information.
To combat brand impersonation and typosquatting, organizations should implement Domain-Based Message Authentication Reporting and Conformance, as well as Sender Policy Framework and DomainKeys Identified Mail. These email security standards help ensure that only authorized senders can use a domain name. Organizations should also monitor the internet for lookalike domains and work with registrars to take down fraudulent sites.
Users should be taught to inspect URLs carefully before clicking, avoid interacting with suspicious emails or pop-ups, and verify that websites use secure connections. Bookmarking frequently used sites and using password managers can also reduce the chance of mistyping a domain and falling into a trap.
As you prepare for the Security Plus exam, remember that impersonation and misinformation attacks are often more about behavior than technology. You may be given a scenario where a user receives a suspicious message or request, and your task will be to identify the type of attack and recommend the appropriate response. Think critically about who is making the request, how it was delivered, and whether the behavior seems unusual or urgent—these are red flags for social engineering.