Network Security Threats: Social Engineering

Active learning works well for this topic because social engineering relies on human behaviour, not just technical knowledge. Students need to experience manipulation firsthand to recognize vulnerabilities in themselves and others, making simulations and debates more effective than lectures alone.

• Year 10
• Computing
• 4 activities
• 30 min–50 min

Learning Objectives

1. Analyze the psychological tactics used in phishing and pharming attacks to manipulate user behaviour.
2. Compare and contrast the methods and impacts of social engineering attacks like pretexting, baiting, and tailgating.
3. Design a public awareness poster that explains the risks of social engineering and provides actionable prevention tips for internet users.
4. Evaluate the effectiveness of different security measures in mitigating human-based network threats.

Role Play

⏱ 35 min·Pairs

Role-Play: Phishing Attack Simulation

Pairs create phishing emails using templates, then swap and identify red flags like urgent language or suspicious links. Discuss defences such as verifying senders. Debrief as a class on common tactics.

Prepare & details

Is the greatest threat to a network's security the software or the human user?

Facilitation Tip: During the phishing simulation, assign each student a role—attacker, victim, or observer—to ensure all perspectives are engaged.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 45 min·Small Groups

Group Debate: Human vs Software Threats

Divide class into teams to argue if humans or software are bigger risks, using evidence from phishing and pharming examples. Rotate speakers and vote on strongest points. Summarise key insights.

Prepare & details

Explain how social engineering tactics manipulate individuals into revealing sensitive information.

Facilitation Tip: For the human vs software debate, require students to cite specific examples from the phishing scenarios or real-world cases to ground their arguments.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 50 min·Small Groups

Campaign Design: Awareness Posters

Small groups research social engineering scams and design posters with examples, warning signs, and tips. Present to class for feedback and vote on most effective.

Prepare & details

Design a public awareness campaign to educate users about common social engineering scams.

Facilitation Tip: When students analyze phishing emails, provide a checklist of red flags to scaffold their scrutiny of technical and emotional cues.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Role Play

⏱ 30 min·Pairs

Pharming Hunt: Website Analysis

Individuals or pairs scrutinise mock websites for pharming clues like mismatched URLs or poor security badges. Log findings and propose verification steps.

Prepare & details

Is the greatest threat to a network's security the software or the human user?

Facilitation Tip: Have students swap posters in the awareness campaign activity and give feedback using a rubric focused on clarity, accuracy, and impact.

Setup: Open space or rearranged desks for scenario staging

Materials: Character cards with backstory and goals, Scenario briefing sheet

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Teaching This Topic

Teachers should model scepticism and curiosity, showing how to question messages and links without assuming malice. Avoid framing this topic as ‘don’t trust anyone,’ which can create paranoia. Instead, emphasize critical thinking and shared responsibility. Research shows that students learn best when they see how subtle cues—like sender names or time pressures—can override good judgment.

What to Expect

Successful learning looks like students who can identify social engineering tactics in real world contexts, explain why human factors are critical to network security, and design preventive measures. They should move from passive awareness to active discernment and advocacy.

Watch Out for These Misconceptions

Common Misconception

During Role-Play: Phishing Attack Simulation, watch for students who believe antivirus software will catch all phishing attempts.

What to Teach Instead

During Role-Play: Phishing Attack Simulation, use the debrief to contrast the simulation outcomes with what antivirus software can and cannot detect. Have students revisit their simulated emails to identify features that bypass automated tools, like urgency or personalization.

Common Misconception

During Group Debate: Human vs Software Threats, watch for students who assume only non-technical people fall for scams.

What to Teach Instead

During Group Debate: Human vs Software Threats, structure the debate so each group defends a scenario from the phishing simulation. Ask them to share personal or observed mistakes, highlighting how even skilled users can be manipulated under pressure.

Common Misconception

During Campaign Design: Awareness Posters, watch for students who believe social engineering requires face-to-face contact.

What to Teach Instead

During Campaign Design: Awareness Posters, incorporate examples from email-based attacks like phishing and pharming. Ask students to include digital cues in their posters, such as domain names or suspicious links, to challenge the misconception.

Assessment Ideas

Exit Ticket

After Role-Play: Phishing Attack Simulation, provide students with three short scenarios describing potential cyber threats. Ask them to identify which scenario represents a social engineering attack, name the specific tactic used, and explain why it is a threat, referencing cues from the simulation.

Discussion Prompt

During Group Debate: Human vs Software Threats, facilitate a class discussion where students must support their arguments with examples of both technical vulnerabilities and social engineering tactics, referencing specific attacks discussed during the phishing simulation and pharming hunt.

Quick Check

After Campaign Design: Awareness Posters, present students with a simulated phishing email. Ask them to identify at least three red flags within the email that indicate it is a scam and explain what action they would take if they received it, using concepts from the awareness campaign.

Extensions & Scaffolding

• Challenge students who finish early to create a phishing email that targets a specific department in the school, then swap with peers for analysis and peer assessment.
• Scaffolding: Provide students who struggle with a partially completed scenario analysis template with sentence starters for identifying red flags.
• Deeper exploration: Invite a cybersecurity professional to discuss how organizations train staff to recognize and report social engineering, connecting classroom learning to real-world practices.

Key Vocabulary

Phishing	A type of social engineering attack where attackers impersonate legitimate organizations or individuals via email, text, or other communication to trick victims into revealing sensitive information or clicking malicious links.
Pharming	A cyberattack that redirects a website's traffic to a fake website, often by compromising DNS (Domain Name System) records, with the goal of stealing user credentials or financial information.
Pretexting	A social engineering technique where an attacker creates a fabricated scenario or 'pretext' to gain trust and persuade a victim to divulge information or perform an action.
Baiting	A social engineering attack that lures victims into a trap by offering something enticing, such as a free download or a physical object like a malware-infected USB drive, in exchange for sensitive data.
Tailgating	An unauthorized physical access technique where an attacker follows an authorized person into a restricted area, often by exploiting politeness or lack of attention.