text: Operating in a Contested Environment
  Social Engineering
  A-69. Social engineering uses techniques that rely on weakness in human nature rather than hardware or
  software. The goal is to deceive people into revealing passwords and other information that compromise the
  security of automated information systems and networks. Adversaries may also use social engineering
  techniques to identify and develop potential targets for phishing and spear phishing.
  A-70. The target of a social engineering attack is an individual. A successful social engineering attack may
  compromise any system to which the affected individual has access.
  Preventive Measures
  A-71. All individuals should maintain operations security and cybersecurity awareness to avoid falling victim
  to a social engineering attack. They should—
  * Confirm the identity of persons asking for personal information or access credentials.
  * Pay close attention to website addresses.
  A-72. As a rule, individuals should avoid disclosing any information to unknown or unverified persons.
  Disclosing even seemingly innocuous information could make subsequent social engineering or spear
  phishing attempts against other targeted individuals seem much more legitimate.
  Indicators
  A-73. Indicators of social engineering attempts include—
  * Unexpected phone calls from unknown callers requesting sensitive information.
  * Websites that do not look normal, have several broken links, or mismatching Internet address.
  * Unauthorized personnel shoulder surfing.
  Reaction
  A-74. If personnel suspect a social engineering attempt, they should—
  * Confirm the requestor’s identity before disclosing information.
  * Report the attempt to supervisors, network managers, and G-2 (S-2).
  * Report social engineering attempts to next higher echelon.
  A-75. Promptly reporting attempts at social engineering can raise awareness and prevent others from falling
  victim to the same techniques.
  Phishing and Spear Phishing
  A-76. Phishing is a fraudulent attempt to obtain sensitive information such as usernames, passwords, and
  credit card details, often for malicious reasons, by disguising as a trustworthy entity in electronic
  communications. Spear phishing is a targeted phishing attempt, usually against key individuals or personnel
  with elevated or special access.
  A-77. Any individual may fall victim to a phishing attack. Key leaders and network administrators are also
  subject to spear phishing.
  Preventive Measures
  A-78. All personnel should protect themselves from phishing attacks by following best practices outlined in
  annual cybersecurity refresher training. Depending on the information operations condition level, the
  command may—
  * Maintain awareness of the personal use of commercial e-mail.
  * Restrict the use of personal e-mail, as required.
  * Block access to commercial e-mail providers.