L2
Lesson 2: Social engineering
Year 9 – Cybersecurity
Items in this lesson
Lesson 2: Social engineering
Year 9 – Cybersecurity
Match the terms with their definitions.
Fact and figures in raw form
Structured data with meaning
Information about a specific person
A set of laws passed by parliament
Data
Information
Personal data
Legislation
In this lesson, you will
Recognise how human errors pose security risks to data
Implement strategies to minimise the risk of data being compromised through human error
Lesson 2: Social engineering
‹#›
Objectives
Which rock star are you?
Starter activity
‹#›
You’ve been a victim of social engineering
Starter activity
How might a hacker use the data that you have willingly given to them?
‹#›
Name
address
Date of birth
Mother’s maiden name
Name of first pet
Favourite colour
Favourite band or artist
Data you submitted
What do you think a hacker/cybercriminal looks like?
Cyberthreat live map
On your mini whiteboards write down:
The top targeted countries
The top targeted industries
The top malware types
There are lots of technical ways to try and keep data safe and secure.
Human error arguably creates the largest risk of the data being compromised.
Social engineering is a set of methods used by cybercriminals to deceive individuals into handing over information that they can use for fraudulent purposes.
Social engineering
‹#›
Activity 1
What’s different about social engineering, in comparison to other cybercrimes, is that it is humans trying to trick or manipulate other humans.
Social engineering
‹#›
Activity 1
Social engineering tactics always use technology to get your personal data.
True
False
Shouldering (also known as shoulder surfing) is an attack designed to steal a victim's password or other sensitive data.
It involves the attacker watching the victim while they provide sensitive information, for example, over their shoulder. This type of attack might be familiar; it is often used to find out someone's PIN at a cash machine.
Shouldering
‹#›
Activity 1
These are attacks in which the victim is asked in an app or a social media post to combine a few pieces of information or complete a short quiz to produce a name.
Attackers do this to find out key pieces of information that can help them to answer the security questions that protect people's accounts.
Name generator attacks
‹#›
Activity 1
What term describes the set of methods cybercriminals
use to deceive people into handing over information for fraudulent purposes?
Cybercrime
Human error
Social media
Social engineering
A phishing attack is an attack in which the victim receives an email disguised to look as if it has come from a reputable source, in order to trick them into giving up valuable data.
The email usually provides a link to another website where the information can be inputted.
Phishing
‹#›
Activity 1
http://l0g1npage.com/B3G7?id=4n
Sending similar messages by SMS is known as smishing.
It is called phishing, as in ‘fishing’, because:
A line is thrown out into a place where there are many potential ‘fish’ (victims)
The line has bait on the end in order to attract the victims
If a victim bites (clicks the link) they are hooked in
Phishing
‹#›
Activity 1
Unexpected email with a request for information
Message content contains spelling errors
Suspicious hyperlinks in email
Text that is hyperlinked to a web address that contains spelling errors and/or lots of random numbers and letters
Text that is hyperlinked to a domain name that you don't recognise and/or isn't connected to the email sender
Generic emails that don't address you by name or contain any personal information that you would expect the sender to know
Phishing: Key indicators of a phishing email
‹#›
Activity 1
Take the phishing quiz
Click here to play the phishing quiz
if you get 0-7 correct try again!
if you get 8 correct you may move on to the extension
if you get 9 correct you will get a green flag!
if you get all 10 correct you will get a green flag + a chocolate bar
Blagging (also known as pretexting) is an attack in which the perpetrator invents a scenario in order to convince the victim to give them data or money.
This attack often requires the attacker to maintain a conversation with the victim until they are persuaded to give up whatever the attacker asked for.
Blagging
‹#›
Activity 2
The following email doesn’t contain a hyperlink to click on, but it does include suspicious information.
Think/pair/share:
Try to find a minimum of three things that make this email suspicious.
Blagging
‹#›
Activity 2
Suspicious punctuation in email (‘Dear <name?>’)
Blagging
‹#›
Activity 2
Spelling mistakes (‘deer friend’)
Unusual use of English (‘a excitable business opportunity’)
Blagging
‹#›
Activity 2
Blagging doesn’t only happen via email.
Which social engineering attack requires a user to click a link in an email and enter personal details?
Blagging
Name generator attack
Phishing
Hacking
Which social engineering attack requires someone to fill
in personal data as part of an online quiz to generate a fun name?
Blagging
Name generator attack
Phishing
Phishing or blagging?
‹#›
Watch this video
Questions
What is the difference between phishing and blagging?
Was what happens on this video phishing or blagging?
What about the email made it suspicious?
Activity 2
Fill in the blanks
Social engineering is the act of manipulating people into doing something they shouldn't by exploiting their emotions or trust. This can be done with or without technology.
Survey
In this lesson, you...
Recognised that human errors pose security risks to data
Looked at strategies to minimise the risk of data being compromised through human error
Next lesson
‹#›
Next lesson, you will…
Look at common methods used by hackers and what laws are in place to act as deterrents
Summary
