Computing · Year 9 · Networks and Cybersecurity · Spring Term

Social Engineering and Phishing

Students will learn to identify social engineering tactics and phishing attempts.

• National Curriculum Attainment Targets
• KS3: Computing - Cybersecurity
• KS3: Computing - Online Safety

About This Topic

Social engineering targets human behaviour rather than technical flaws, positioning people as the weakest link in cybersecurity. In Year 9, students identify tactics such as pretexting, where attackers pose as trusted figures, baiting with enticing offers, and phishing emails that urge urgent action or personal data sharing. They critique sample emails for red flags like unexpected requests, poor grammar, or suspicious links, and design strategies like verifying sources and using multi-factor authentication.

This topic aligns with KS3 Computing standards on cybersecurity and online safety within the Networks unit. It fosters critical thinking and ethical decision-making, skills essential for safe digital citizenship. Students connect real-world examples, such as ransomware attacks via tricked employees, to broader network vulnerabilities studied earlier.

Active learning suits this topic because threats feel abstract until simulated. Role-plays and email dissections make risks personal and immediate, boosting retention and confidence in applying defences. Collaborative critiques reveal diverse perspectives, helping students internalise vigilance as a habit.

Key Questions

1. Explain why social engineering is often considered the weakest link in cybersecurity.
2. Critique a given email to determine if it is a phishing attempt.
3. Design strategies to protect oneself from common social engineering attacks.

Learning Objectives

• Analyze the psychological principles underlying common social engineering tactics like pretexting and baiting.
• Critique sample phishing emails to identify specific indicators of malicious intent, such as urgent calls to action or requests for sensitive data.
• Design a personal defense strategy incorporating at least three distinct methods to mitigate social engineering risks.
• Compare and contrast the effectiveness of technical security measures versus human-factor defenses against cyber threats.

Before You Start

Introduction to Networks

Why: Understanding basic network concepts helps students grasp how cyberattacks can spread and impact systems.

Online Safety Basics

Why: Students need foundational knowledge of safe internet practices to understand the risks associated with social engineering and phishing.

Key Vocabulary

Social Engineering	The art of manipulating people into performing actions or divulging confidential information, often exploiting psychological biases.
Phishing	A type of social engineering attack where attackers impersonate legitimate entities via electronic communication, usually email, to trick individuals into revealing sensitive data or installing malware.
Pretexting	A social engineering tactic where an attacker creates a fabricated scenario, or pretext, to gain trust and obtain information from a victim.
Baiting	A social engineering tactic that lures victims into a trap by offering something enticing, such as a free download or a physical infected USB drive.
Spear Phishing	A targeted phishing attack that is customized to a specific individual or organization, making it more convincing and harder to detect.

Watch Out for These Misconceptions

Common Misconception

Phishing emails always contain obvious spelling errors or bad design.

What to Teach Instead

Sophisticated phishing mimics legitimate sources closely. Group dissections of varied examples show subtle cues like mismatched domains. Active discussions help students build nuanced checklists beyond surface errors.

Common Misconception

Social engineering only occurs online through emails.

What to Teach Instead

It includes phone calls, USB drops, or in-person tricks. Role-plays across mediums reveal patterns. Peer teaching in scenarios corrects narrow views and builds comprehensive awareness.

Common Misconception

Antivirus software fully protects against social engineering.

What to Teach Instead

It scans files, not human choices. Simulations demonstrate bypasses, emphasising behaviour. Hands-on critiques shift focus to personal vigilance as primary defence.

Active Learning Ideas

Email Critique Carousel

Print 6-8 sample emails, some phishing, some legitimate. Groups rotate every 7 minutes to analyse sender, content, links, and urgency. They vote and justify if phishing, then debrief as a class.

45 min·Small Groups

Phishing Role-Play Scenarios

Pairs draw scenario cards like 'boss emails urgent password request'. One acts as attacker, other as victim spotting tactics. Switch roles, then share strategies that worked.

30 min·Pairs

Defence Strategy Design

In small groups, students brainstorm and poster personal protection plans covering email, calls, and public Wi-Fi. Include checklists and slogans. Present to class for feedback.

40 min·Small Groups

Spot the Scam Hunt

Provide website screenshots or texts. Individually mark phishing indicators with highlighters, then pairs compare and create a class master list of clues.

25 min·Individual

Real-World Connections

• The 2016 Democratic National Committee (DNC) email hack is a prime example of spear phishing, where personalized emails were used to compromise accounts and expose sensitive information.
• Many large corporations, including banks like HSBC and technology firms like Microsoft, regularly conduct simulated phishing campaigns internally to test employee awareness and provide targeted training.
• Cybersecurity analysts at companies like Sophos or Norton routinely investigate phishing attempts reported by users, analyzing the methods used to improve detection and prevention tools.

Assessment Ideas

Quick Check

Present students with three anonymized email examples: one legitimate, one phishing, and one spear phishing. Ask them to label each and provide one specific reason for their classification for each email.

Discussion Prompt

Pose the question: 'Why is it often said that humans are the weakest link in cybersecurity?' Facilitate a class discussion where students share examples of social engineering they have encountered or heard about, and discuss the vulnerabilities exploited.

Peer Assessment

In pairs, students draft a short, fictional social engineering scenario (e.g., a phone call asking for account details). They then swap scenarios and write down two specific questions they would ask to verify the caller's identity and one action they would take to protect themselves.

Frequently Asked Questions

Why is social engineering the weakest link in cybersecurity?

Attackers exploit trust and curiosity faster than fixing tech gaps. People click links or share info under pressure, bypassing firewalls. Teaching this builds student awareness that no system is secure without human caution, linking to network lessons on layered defences.

How can students spot phishing emails?

Check sender domain, hover over links without clicking, verify requests via other channels. Urgent language or rewards signal tricks. Practice with mixed samples hones judgement, reducing real risks like data theft.

How does active learning help teach social engineering?

Simulations like role-plays make abstract tactics tangible, increasing engagement and recall. Group critiques expose blind spots and build collective strategies. Students practice responses in safe settings, turning knowledge into instinctive habits vital for online safety.

What strategies protect against social engineering attacks?

Verify identities independently, pause before acting on requests, use password managers and 2FA. Report suspicions promptly. Classroom designs let students tailor plans, reinforcing proactive habits across digital and physical contexts.