Cyber Security
Internet and Its Uses
manipulates people into giving away confidential information or access, by exploiting human trust rather than technical weaknesses.
Instead of attacking the computer, the attacker attacks the person. They might phone an employee while pretending to be IT support and ask for a password, leave an infected USB stick where a curious person will plug it in, or create a sense of fear or urgency that pressures the victim into acting without thinking. Phishing is one common form of social engineering. The defence is awareness and following security procedures, because no firewall can stop a user who is tricked into handing over their own details.
Exam tip
Describing social engineering with an example
A question asking you to describe social engineering and include an example (3 marks) gives two marks to the description and one to the example. The description needs both halves: the attacker manipulates, deceives or tricks people, and does it to get hold of their data or to push them into making a mistake. Then add one realistic example, such as a caller posing as IT support who asks for a password, or an infected USB stick left where someone will plug it in. Leave the example out and two marks is the most you can score.