A housing-authority IR playbook categorizes how adversaries first get in. Where does social engineering correctly belong?
Select an answer to reveal the explanation.
Short Explanation
SE is often the front door—same neighborhood as malware and vuln exploits, not the janitor closet after the break-in. IR playbooks should list it with other initial-access paths.
Full Explanation
In housing-authority and other municipal incident-response models, social engineering correctly belongs as an initial-access path alongside malware delivery and vulnerability exploitation. Adversaries use SE to induce credential disclosure, malicious execution, MFA fatigue compliance, or physical entry that opens the environment for further stages. IR playbooks that omit SE from initial access under-detect the most common civic entry narratives and mis-sequence containment priorities.
Treating SE only as a post-exploitation cleanup step fails by concept: that places the human vector after compromise is already underway and misses prevention and early detection. Framing SE solely as a physical facilities issue unrelated to cyber initial access ignores credential and payload pathways that are core cyber IR concerns. Delegating SE only to public-affairs as a marketing problem removes it from technical detection, identity controls, and SOC response.
Exam caveat: SE can appear in multiple kill-chain stages (for example, pretext during lateral movement), but the fundamental categorization for entry models remains initial access. Physical SE and cyber-enabled SE both matter; playbooks should cross-reference facilities and IT without collapsing SE into not-cyber. Do not confuse awareness training ownership with IR categorization.
Operational check: Open the IR initial-access taxonomy and confirm SE, phishing, and pretext entries exist with detection sources such as email gateway alerts, help-desk reset anomalies, and badge tailgating reports. Run a tabletop where the first event is a convincing pretext call leading to a reset, and verify responders treat it as initial access rather than waiting for malware alerts.