Computer Science · 10th Grade

Active learning ideas

Social Engineering Tactics

Active learning works especially well for social engineering tactics because students often underestimate how easily human psychology can be manipulated. By practicing real-world scenarios, they move from abstract warnings to concrete recognition of tactics they encounter daily.

• Common Core State Standards
• CSTA: 3A-NI-05
• CSTA: 3A-NI-07

• 30–45 min
• Pairs → Whole Class
• 3 activities

Activity 01

• Role Play
• 30 min · Pairs

Role-Play: Phishing Phone Call Simulation

In pairs, one student plays an attacker using a provided pretexting script (e.g., IT helpdesk asking for password verification) and the other plays a target employee. After two minutes, they switch and debrief: what psychological triggers were used and what questions would have exposed the deception?

Explain why the human element is often the weakest link in security.

Facilitation Tip

During the phishing phone call simulation, provide each student with a role card that includes a clear pretext and emotional trigger to practice, ensuring everyone experiences the pressure tactics feel real.

What to look for

Provide students with three short scenarios describing potential cyber threats. Ask them to identify which scenario is an example of social engineering, name the specific tactic used (e.g., phishing, pretexting), and explain why it works.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Case Study Analysis
• 45 min · Small Groups

Case Study Analysis: Notable Social Engineering Attacks

Small groups receive a one-page summary of a documented social engineering attack (e.g., the 2011 RSA SecurID breach initiated via a spear-phishing email). Groups identify the tactic used, the psychological lever exploited, and three specific countermeasures. Each group presents a 90-second summary.

Analyze common social engineering tactics like pretexting and baiting.

Facilitation Tip

For the case study analysis, assign small groups specific roles such as investigator, analyst, and reporter to ensure all students contribute to unpacking the attack details.

What to look for

Pose the question: 'Why is it often easier for an attacker to trick a person than to break through a strong technical firewall?' Facilitate a class discussion where students share their reasoning, connecting it to the psychological principles discussed.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 03

• Gallery Walk
• 35 min · Whole Class

Gallery Walk: Tactics and Defenses

Post six stations around the room, each describing a social engineering tactic with a brief scenario. Students rotate through all stations and at each one write one defense strategy on a sticky note. Close with a class discussion comparing overlapping defenses and identifying which tactics are hardest to counter.

Design strategies to protect oneself from social engineering attacks.

Facilitation Tip

In the gallery walk, place tactic posters at eye level and include a 'defense tip' section on each so students connect recognition with actionable responses immediately.

What to look for

Present students with a list of common psychological triggers (e.g., urgency, authority, fear, curiosity). Ask them to match each trigger to a specific social engineering tactic and provide a brief justification for their pairing.

• Understand
• Apply
• Analyze
• Create
• Relationship Skills
• Social Awareness

A few notes on teaching this unit

Approach this topic with empathy, acknowledging that students may feel embarrassed about past experiences with scams. Use anonymized student examples to normalize vulnerability, then focus on building analytical skills rather than shame. Research shows that scenario-based learning with immediate feedback helps students internalize defenses more effectively than lectures alone.

Students will demonstrate the ability to identify social engineering tactics in multiple contexts, explain the psychological triggers used, and articulate clear defense strategies. Success looks like thoughtful analysis during discussions and accurate identification in role-play feedback.

---

Watch Out for These Misconceptions

• During the role-play phishing phone call simulation, some students may believe only people who lack technical knowledge fall for scams.

  Use the debrief after the simulation to share documented cases of security experts and executives who fell for sophisticated pretexts, highlighting how attackers research their targets thoroughly before contacting them.

• During the gallery walk, students may assume social engineering only involves phishing emails.

  Point students to the 'tactics and defenses' posters that include vishing, baiting, and impersonation, and ask them to identify which posters contradict their initial assumption.

---

Methods used in this brief

• Role Play
• Case Study Analysis
• Gallery Walk