Cybersecurity Challenges in Social Media Erdal Ozkaya

3.3.2
 
Elicitation 
Even with their weaknesses, humans will generally be withdrawn at first from 
confiding in anyone. It takes skills to be able to break people from their comfort zones so that 
they can start spewing out private information (Heartfield & Loukas, 2016). Elicitation is 
more than building rapport with strangers, it’s a technique used in interrogation rooms, used 
by therapists and by doctors to get information from people that they would otherwise 
withhold. Elicitation, therefore, is the second step in the social engineering framework that is 
followed during social engineering attacks. The attackers use elicitation techniques after 
gathering enough information about a target to initialize a conversation. 
3.3.3
 
Pretexting 
This is normally the third step in a social engineering attack. It is where the attacker 
becomes anyone in a position to influence the target into making some decisions. The 
attacker chooses a certain personality that befits the character he or she opts to become during 

---

48 
the social engineering attempt (Heartfield & Loukas, 2016). With the advent of the Internet, it 
is easy to become anyone. There are so many informational resources that a social engineer 
can use to adapt the character of anyone. Pretexting is an imperative skill that any social 
engineer needs in order to accomplish an attack. Pretexting is more than just acting the role of 
a person, it can be considered as becoming the person. There should not be an iota of doubt to 
the target that the social engineer is not the person he or she claims to be. The social 
engineer's character, the manner of speech, body language and any other noticeable 
characteristic must fit that of the person he or she is pretending to be. It is a vital skill that 
will allow a social engineer to carry out an attack unsuspected.