Regarding #SocialEngineering I love the work of Frank Stajano and Paul Wilson. The documented 7 common principles of #scams.
The principles are (in my adaption)
- Need or Greed / Bait: Something the victim/mark wants or wants to avoid.
- Deception: A connection to reality
- Distraction: an elaborate story around the scam hiding the true intentions.
- Authority or Trust: Scams "originate" often trusted or authoritative person, role, or organisation
- Time pressure & timing: The victims are pressured to decide or act quickly. And the attacks are timed, often after lunch, or the afternoon were the victim is like less energetic and attentive.
- Secrecy (or Dishonesty): keep the mark from asking someone else.
and may slightly less relevant in a digital Social Engineering context:
- Herd/Group Principle: Others are doing it as well, so I either have FOMO or think it can't be that bad
You can read more in https://www.cl.cam.ac.uk/~fms27/papers/2011-StajanoWil-scam.pdf
