Computer Science · 11th Grade

Active learning ideas

Social Engineering and Human Factors

Active learning works for social engineering because students must experience the manipulation tactics firsthand to truly understand their power. Role-play and simulations create emotional stakes that passive lessons cannot, making abstract concepts like authority bias feel tangible. This topic demands experiential practice to override the common belief that technical defenses alone can prevent attacks.

• Common Core State Standards
• CSTA: 3B-IC-28

• 25–40 min
• Pairs → Whole Class
• 4 activities

Activity 01

• Role Play
• 30 min · Pairs

Role Play: Social Engineering Attack Simulation

In pairs, one student plays a social engineer using a prepared script based on a real pretexting or vishing scenario, and the other plays a target. After two minutes, pairs debrief: what pressure techniques were used, what felt persuasive, what signals should have prompted suspicion. The class compiles a master list of identified tactics and the psychological principles each exploits.

Analyze why the human element is often the weakest link in cybersecurity.

Facilitation Tip

During the Role Play activity, assign roles strictly to avoid awkwardness, and provide a script with key phrases attackers use so students recognize patterns rather than improvising.

What to look for

Pose the following to students: 'Imagine you receive an urgent email from your bank asking you to click a link to verify your account due to suspicious activity. What are the red flags? What psychological tactics might the sender be using, and how would you respond safely?'

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 02

• Case Study Analysis
• 40 min · Small Groups

Case Study Analysis: Documented Social Engineering Attacks

Groups each analyze a documented attack: the Twitter Bitcoin hack of 2020, the RSA SecurID breach of 2011, the 2011 HBGary Federal incident, or a business email compromise case. Groups present the psychological techniques used and identify what organizational or individual response could have interrupted the attack at each stage.

Explain common social engineering tactics and how to recognize them.

Facilitation Tip

For the Case Study Analysis activity, give students a graphic organizer to systematically break down each attack into the exploited bias, target, and outcome.

What to look for

Present students with 3-4 short scenarios describing potential social engineering attempts (e.g., a phone call claiming to be from tech support, a social media message offering a prize). Ask students to identify the type of social engineering tactic used and explain why it is a threat.

• Analyze
• Evaluate
• Create
• Decision-Making
• Self-Management

Activity 03

• Role Play
• 35 min · Small Groups

Design Challenge: Security Awareness Training Module

Groups design a 10-minute security awareness training segment for a specific audience (new employees, elderly family members, middle school students). They specify learning objectives, the scenario they will use to illustrate the threat, and how they will assess whether participants can recognize it afterward. Groups deliver a portion of their module to the class.

Design training programs to improve human resilience against social engineering attacks.

Facilitation Tip

During the Design Challenge, require students to prototype their training module for a specific audience, such as new employees or high school students, to focus their messaging.

What to look for

Students draft a short social engineering awareness tip for a specific platform (e.g., social media, email). They then exchange their tips with a partner and provide feedback on clarity, accuracy, and effectiveness in a sentence or two.

• Apply
• Analyze
• Evaluate
• Social Awareness
• Self-Awareness

Activity 04

• Gallery Walk
• 25 min · Pairs

Gallery Walk: Social Engineering Tactics

Post descriptions of six social engineering tactics (phishing, vishing, pretexting, baiting, quid pro quo, tailgating) at stations. Student pairs annotate each with a realistic scenario, the psychological principle being exploited, and a practical counter-response that does not require technical knowledge.

Analyze why the human element is often the weakest link in cybersecurity.

Facilitation Tip

For the Gallery Walk, post tactics on large posters with space for student annotations, and rotate groups every 5 minutes to maintain engagement.

What to look for

Pose the following to students: 'Imagine you receive an urgent email from your bank asking you to click a link to verify your account due to suspicious activity. What are the red flags? What psychological tactics might the sender be using, and how would you respond safely?'

• Understand
• Apply
• Analyze
• Create
• Relationship Skills
• Social Awareness

A few notes on teaching this unit

Approach this topic by normalizing mistakes rather than shaming them, as even cybersecurity professionals fall for social engineering. Research from Carnegie Mellon shows that students learn best when they analyze their own susceptibility rather than just studying attacks from a distance. Avoid lecturing about tactics; instead, let students discover vulnerabilities through structured discovery. Model curiosity by asking, 'Why did that feel convincing?' instead of 'What was wrong with that?'

Successful learning looks like students accurately identifying manipulation tactics in real-time scenarios and articulating why technical solutions are insufficient. They should demonstrate empathy for targets of social engineering while maintaining critical skepticism toward persuasive techniques. By the end, students will confidently assess risks in common communication channels like email and phone calls.

---

Watch Out for These Misconceptions

• During the Role Play activity, watch for students assuming only 'gullible' people get tricked.

  Use the Role Play scripts to highlight that even IT staff and executives fall for these tactics; have students debrief by sharing moments when the simulated attack felt plausible, emphasizing universal cognitive biases like authority and urgency.

• During the Case Study Analysis activity, some students may believe stronger passwords solve social engineering.

  Direct students to analyze case studies where technical controls failed (e.g., compromised accounts despite strong passwords) and highlight how attackers bypassed authentication entirely by manipulating users into taking direct actions.

• During the Design Challenge activity, students might think one training session is enough.

  Use the Design Challenge rubric to require evidence of ongoing reinforcement in their training modules, such as monthly phishing simulations or progressive difficulty levels, citing research that single sessions are ineffective.

---

Methods used in this brief

• Role Play
• Case Study Analysis
• Gallery Walk