Shoulder surfing (盗み見) is obtaining information improperly by looking at someone's screen, papers or what they are typing, without that person noticing.
The trick of peeking at a screen or someone's hands from behind is also called a shoulder hack (shoulder hacking). It works with nothing more than human eyes and needs no special tools.
AnalogyIt is like the person queuing behind you at an ATM quietly watching your hand as you enter your PIN.
How to rememberIn English it is called shoulder surfing. Picture someone looking at a screen over your shoulder.
Exam points
ExamA shoulder hack (ショルダーハック) counts as a form of social engineering (ソーシャルエンジニアリング), which obtains information by exploiting carelessness or psychological gaps in people.
ExamOne direct safeguard against peeking is a privacy filter (のぞき見防止フィルタ), which makes a screen hard to see from the side or behind.
Eavesdropping (盗聴) is intercepting (傍受) data in transit over a communication path such as a network and reading its contents improperly.
If unencrypted communication is intercepted, its contents may be read as they are. If the communication is encrypted beforehand, the contents are hard to read even when intercepted.
AnalogyIt is like tying another string onto a tin-can telephone line to secretly listen in on two people talking.
How to rememberThe character 聴 contains the "ear" radical. Remember it as listening in on an exchange from the side.
Exam points
ExamEavesdropping (盗聴), which intercepts communication and reads its contents, is not social engineering (ソーシャルエンジニアリング), which obtains information by exploiting carelessness or psychological gaps in people.
ExamEavesdropping reads the contents of communication, and it is different from a backdoor (バックドア), a mechanism left on a compromised computer for getting back in.
Impersonation (なりすまし) means posing as another person or a legitimate organization and acting as them to obtain information or carry out improper operations.
Besides logging in with a stolen ID and password, it can also mean faking an identity by phone or email to deceive someone. The basic countermeasure is user authentication, which checks whether the other party really is who they claim to be.
AnalogyIt is like wearing someone else's name badge to slip into a meeting and speak as that person.
How to rememberThe Japanese verb 成り済ます means to become someone completely.
Exam points
ExamDeceiving people under a false identity to draw out passwords or confidential information is social engineering, and impersonation (なりすまし) is a typical means of it.
ExamThe sender address of an email (電子メール) can be forged. Even a message from the address of someone you know may not have been sent by that person.
BEC is a scam that deceives staff with emails impersonating an executive or business partner, getting them to send money to an account the attacker has prepared.
The attacker sends an email posing as a business partner or the like
The staff member believes the request is genuine
The money is sent to the attacker's account
If the money is sent without checking, it ends up with the attacker.
3 / 3
It is short for Business Email Compromise, and in Japanese it is called business email fraud. For example, attackers say the payee account has changed or press for an urgent payment, leaving no time to check.
AnalogyIt is like a fake note in imitation of the boss's handwriting that gets the person in charge of the safe to hand over money.
How to rememberThe C stands for Compromise. It is a scam in which business email exchanges are exploited by an attacker.
Exam points
Mix-upUnlike phishing (フィッシング), which lures large numbers of unspecified people to fake websites, BEC targets the people who handle payments at a specific company to swindle money.
Business email fraud (ビジネスメール詐欺) is the Japanese name for BEC and refers to the same scam.
To avoid losses, when you receive a request such as a change of payee account, confirm with the requester using contact details not given in the email, such as a phone number you already knew. A system in which several people inside the company approve each payment is also a safeguard.
How to rememberA scam using business (trade) email: the name itself describes the method.
Exam points
Mix-upBusiness email fraud (ビジネスメール詐欺) and BEC are the Japanese name and the abbreviation for the same thing, not two separate threats.
Insider fraud (内部不正) is when someone inside an organization, such as an employee, abuses the access rights they were given to deliberately take information out, tamper with data, and so on.
Because it uses legitimate access rights, it is harder to detect than an attack from outside. Countermeasures include limiting access rights to what the job needs and keeping and reviewing records of operations (logs). Promptly disabling the accounts of people who have left also helps prevent information from being taken out.
AnalogyIt is like a shop clerk entrusted with the key to the safe taking its contents for themselves.
Operational error (誤操作) is when a person with no ill intent makes a mistake in operation, causing information to leak or data to be lost.
Information security threats can be divided, for example, into human, physical and technical ones, and operational error is a human threat caused by people. It takes forms such as sending an email to the wrong recipient or deleting needed data, and it is guarded against by checking before sending, double-checking and backups.
AnalogyIt is like delivering a hastily written letter to a different house with a similar name.
Exam points
ExamOperational error (誤操作) is caused by human mistakes, so it is a human threat (人的脅威), which is classified differently from a physical threat (物理的脅威) such as a disaster like an earthquake or fire.
Mix-upOperational error is an honest mistake, and it differs in intent from insider fraud (内部不正), which deliberately abuses access rights.
Obtaining information by exploiting people's carelessness or assumptions is called social engineering, and shoulder surfing and impersonation by phone are examples of it.
The sender of an email and the name given on a phone call can be faked, so confirm by another means whether the other party is really who they say.
BEC (business email fraud) is a scam that gets money sent through impersonation emails, so confirm any payment request using contact details you already knew.
Threats come not only from outside the organization but also from people inside it, and narrowing access rights, reviewing logs and checking procedures guard against them.