Computing · Year 10 · Connected Networks · Summer Term

Network Security Threats: Social Engineering

Understanding phishing, pharming, and other human-based attacks.

• National Curriculum Attainment Targets
• GCSE: Computing - Network Security

About This Topic

Social engineering targets human weaknesses to breach networks, bypassing technical defences. Year 10 students examine phishing, where deceptive emails lure users to fake sites for credential theft; pharming, which poisons DNS caches to redirect traffic; and tactics like pretexting, baiting, or tailgating. These methods rely on trust, urgency, or curiosity to manipulate behaviour, showing why users often represent the greatest security risk.

This topic fits GCSE Computing standards on network security within the Connected Networks unit. Students tackle key questions, such as whether humans or software pose bigger threats, how tactics exploit psychology, and how to design awareness campaigns. Lessons build skills in threat analysis, ethical decision-making, and persuasive communication, preparing students for real-world digital citizenship.

Active learning suits this topic perfectly. Role-plays of attack scenarios let students experience manipulation firsthand, while collaborative campaign design reinforces prevention strategies. These approaches make threats relatable, boost retention through peer feedback, and foster proactive habits that extend beyond the classroom.

Key Questions

1. Is the greatest threat to a network's security the software or the human user?
2. Explain how social engineering tactics manipulate individuals into revealing sensitive information.
3. Design a public awareness campaign to educate users about common social engineering scams.

Learning Objectives

• Analyze the psychological tactics used in phishing and pharming attacks to manipulate user behaviour.
• Compare and contrast the methods and impacts of social engineering attacks like pretexting, baiting, and tailgating.
• Design a public awareness poster that explains the risks of social engineering and provides actionable prevention tips for internet users.
• Evaluate the effectiveness of different security measures in mitigating human-based network threats.

Before You Start

Introduction to Cybersecurity

Why: Students need a basic understanding of what cybersecurity is and why protecting networks is important before learning about specific threats.

Basic Network Concepts

Why: Understanding how networks function, including concepts like IP addresses and websites, is necessary to grasp how attacks like pharming work.

Key Vocabulary

Phishing	A type of social engineering attack where attackers impersonate legitimate organizations or individuals via email, text, or other communication to trick victims into revealing sensitive information or clicking malicious links.
Pharming	A cyberattack that redirects a website's traffic to a fake website, often by compromising DNS (Domain Name System) records, with the goal of stealing user credentials or financial information.
Pretexting	A social engineering technique where an attacker creates a fabricated scenario or 'pretext' to gain trust and persuade a victim to divulge information or perform an action.
Baiting	A social engineering attack that lures victims into a trap by offering something enticing, such as a free download or a physical object like a malware-infected USB drive, in exchange for sensitive data.
Tailgating	An unauthorized physical access technique where an attacker follows an authorized person into a restricted area, often by exploiting politeness or lack of attention.

Watch Out for These Misconceptions

Common Misconception

Antivirus software fully protects against social engineering.

What to Teach Instead

These attacks exploit human decisions, not just code vulnerabilities. Role-plays help students see how emotional triggers override tech tools, while group analysis of real examples builds discernment skills.

Common Misconception

Only non-technical people fall for phishing.

What to Teach Instead

Skilled users err under pressure or familiarity bias. Simulations reveal universal risks, and peer teaching in debates corrects overconfidence through shared stories.

Common Misconception

Social engineering requires direct contact.

What to Teach Instead

Digital methods like email suffice. Hands-on email crafting shows subtlety, with class critiques highlighting overlooked cues in remote attacks.

Active Learning Ideas

Role-Play: Phishing Attack Simulation

Pairs create phishing emails using templates, then swap and identify red flags like urgent language or suspicious links. Discuss defences such as verifying senders. Debrief as a class on common tactics.

35 min·Pairs

Group Debate: Human vs Software Threats

Divide class into teams to argue if humans or software are bigger risks, using evidence from phishing and pharming examples. Rotate speakers and vote on strongest points. Summarise key insights.

45 min·Small Groups

Campaign Design: Awareness Posters

Small groups research social engineering scams and design posters with examples, warning signs, and tips. Present to class for feedback and vote on most effective.

50 min·Small Groups

Pharming Hunt: Website Analysis

Individuals or pairs scrutinise mock websites for pharming clues like mismatched URLs or poor security badges. Log findings and propose verification steps.

30 min·Pairs

Real-World Connections

• Financial institutions like Barclays Bank and major online retailers such as Amazon regularly issue warnings and provide educational resources to customers about identifying and avoiding phishing scams that target their account details.
• IT security professionals in large corporations, such as Google or Microsoft, are responsible for designing and implementing security awareness training programs to educate employees about social engineering threats and safe online practices.
• Government agencies like the National Cyber Security Centre (NCSC) in the UK publish guides and alerts to inform the public about current online threats, including common social engineering tactics used in scams.

Assessment Ideas

Exit Ticket

Provide students with three short scenarios describing potential cyber threats. Ask them to identify which scenario represents a social engineering attack, name the specific tactic used (e.g., phishing, baiting), and explain why it is a threat.

Discussion Prompt

Pose the question: 'Is the greatest threat to a network's security the software or the human user?' Facilitate a class discussion where students must support their arguments with examples of both technical vulnerabilities and social engineering tactics, referencing specific attacks discussed in class.

Quick Check

Present students with a simulated phishing email. Ask them to identify at least three red flags within the email that indicate it is a scam and explain what action they would take if they received it.

Frequently Asked Questions

How does social engineering differ from malware attacks?

Social engineering manipulates people to act against their interests, such as sharing passwords via phishing, while malware infects devices automatically. Students grasp this through examples: pharming redirects browsers without code execution. Lessons emphasise psychology over technology, using case studies to show hybrid threats where human error enables malware.

What active learning strategies work best for teaching social engineering?

Role-plays and simulations immerse students in attacker-victim dynamics, making abstract tactics concrete. Pair email creation and defence exercises build pattern recognition, while group campaigns develop advocacy skills. These methods outperform lectures by encouraging reflection, peer critique, and application, leading to deeper understanding and behaviour change.

How to address key questions on human threats in network security?

Start with data: most breaches stem from user errors. Use debates to explore software vs human risks, phishing dissections for manipulation tactics, and project-based campaigns for solutions. This sequence aligns with GCSE demands, fostering evidence-based arguments and practical designs.

What real-world examples illustrate pharming and phishing?

Pharming hit banks by altering DNS on routers; phishing scams mimic HMRC for tax data. Analyse these in class via timelines and victim quotes. Students then create defences, linking examples to prevention like two-factor authentication and URL checks, vital for UK digital safety.