Computer Science · 9th Grade · The Architecture of the Internet · Weeks 10-18

Human Factors in Cybersecurity

Students will examine how human factors contribute more to security breaches than technical failures.

• Common Core State Standards
• CSTA: 3A-NI-06

About This Topic

Technical defenses handle the machine-to-machine layer of security, but people are consistently the most exploited attack surface in any organization. Research consistently shows that human error -- clicking phishing links, reusing passwords, misconfiguring systems -- is the proximate cause in the majority of data breaches. For 9th graders in the United States, this topic reframes cybersecurity from a purely technical problem to a human systems problem.

Social engineering encompasses the techniques attackers use to manipulate people rather than hack systems directly. Phishing is the most common form, but vishing (phone calls impersonating tech support or government agencies), pretexting (fabricating a scenario to gain trust), and baiting (leaving infected USB drives in accessible locations) are all documented attack vectors. Understanding these techniques is not about paranoia -- it is about building a realistic threat model.

The solution is training, process design, and security culture. An effective security awareness program does not just list threats; it places people in realistic simulated situations so they recognize attack patterns under actual conditions. Active learning is particularly well-matched to this topic because the skills being developed -- skepticism, verification habits, phishing detection -- are behaviors that require practice, not just knowledge.

Key Questions

1. Explain how human factors contribute more to security breaches than technical failures.
2. Analyze common social engineering techniques used in cyberattacks.
3. Design a training program to improve human cybersecurity awareness.

Learning Objectives

• Analyze common social engineering techniques, identifying the psychological principles exploited in each.
• Evaluate the effectiveness of various human-centric cybersecurity training methods.
• Design a cybersecurity awareness campaign for a specific audience, incorporating at least three different attack vectors.
• Explain why human error is often the primary cause of security breaches, citing at least two specific examples.
• Compare and contrast technical security measures with human-based defenses against cyber threats.

Before You Start

Basic Internet Safety

Why: Students need foundational knowledge of safe online practices to understand the vulnerabilities exploited by social engineering.

Introduction to Computer Networks

Why: Understanding how data is transmitted helps students grasp the context in which security breaches occur.

Key Vocabulary

Phishing	A type of social engineering attack where attackers impersonate legitimate entities via email, text, or other communication to trick individuals into revealing sensitive information or downloading malware.
Social Engineering	The psychological manipulation of people into performing actions or divulging confidential information, rather than hacking into systems.
Vishing	Voice phishing, a social engineering attack conducted over the phone, often impersonating trusted organizations or individuals to extract information.
Pretexting	A social engineering technique where an attacker creates a fabricated scenario or pretext to gain trust and elicit information or access from a victim.
Baiting	A social engineering tactic that lures victims into a trap by offering something enticing, such as a free download or a physical object like a malware-infected USB drive.

Watch Out for These Misconceptions

Common Misconception

Only careless or uneducated people fall for phishing.

What to Teach Instead

Security researchers and IT professionals have been successfully phished in documented cases. Sophisticated spear-phishing campaigns are crafted specifically using information gathered about the target. Role-play exercises that simulate real social engineering make this non-judgmental and evidence-based.

Common Misconception

Better security software will eventually eliminate the human problem.

What to Teach Instead

No software patch fixes human psychology. Social engineering succeeds by exploiting cognitive shortcuts like urgency, authority, and familiarity that are features of human cognition, not bugs to be patched. Role-play that simulates real social engineering attempts makes this viscerally clear.

Active Learning Ideas

Role-Play: Social Engineering Scenarios

Students work in pairs. One plays an attacker using a pretexting script, such as 'Hi, I'm from IT -- I need your password to fix your account.' The other plays the target, practicing how to verify the caller's identity and decline the request safely. Groups debrief on which techniques felt most convincing.

25 min·Pairs

Collaborative Design: Security Awareness Campaign

Groups design a three-part security awareness program for their school: a poster, a five-minute activity, and a quick-reference card. They present their programs and the class votes on which is most likely to actually change behavior and why.

40 min·Small Groups

Case Study Analysis: Inside the Human Breach

Groups analyze the 2011 RSA SecurID breach, in which an employee opened a phishing email titled '2011 Recruitment Plan.' They identify every human decision point where the attack could have been stopped and propose process changes for each.

30 min·Small Groups

Think-Pair-Share: Why Do People Fall For It?

Students individually list three cognitive biases that social engineers exploit, such as urgency, authority, or familiarity. Pairs combine their lists and find examples of each in real phishing messages. The class builds a master list of psychological levers attackers use.

20 min·Pairs

Real-World Connections

• Employees at major financial institutions like JPMorgan Chase receive regular simulated phishing tests to gauge their awareness and reinforce training on identifying malicious emails.
• Healthcare providers such as Kaiser Permanente must train their staff on recognizing vishing attempts that impersonate IT support or insurance providers to protect patient data.
• Government agencies, including the FBI, investigate cybercrimes that often begin with social engineering attacks, highlighting the need for public awareness campaigns.

Assessment Ideas

Exit Ticket

Provide students with three short scenarios describing potential cyber threats. Ask them to identify the type of social engineering attack in each scenario and explain one specific action they would take to avoid falling victim.

Quick Check

Present students with a simulated phishing email. Ask them to highlight at least three red flags that indicate the email is malicious and explain why each is a warning sign.

Discussion Prompt

Facilitate a class discussion using the prompt: 'Imagine you receive a phone call from someone claiming to be from your internet provider, stating your service will be disconnected unless you immediately provide your account password. How would you respond, and why is this a common social engineering tactic?'

Frequently Asked Questions

Why are humans considered the biggest cybersecurity vulnerability?

People can be manipulated through social pressure, urgency, and trust in ways that software cannot be. Attackers exploit predictable human responses -- helpfulness, fear of authority, time pressure -- to bypass technical defenses. Training changes behavior over time; it does not eliminate vulnerability entirely, but it significantly raises the cost for attackers.

What is social engineering?

Social engineering is manipulation that exploits human psychology rather than technical vulnerabilities to gain unauthorized access. Common techniques include phishing (deceptive emails), vishing (fraudulent phone calls), pretexting (fabricating a false context to gain trust), and baiting (physical or digital traps that exploit curiosity).

What makes a security awareness training program actually effective?

Effective programs use realistic, repeated simulated attacks rather than one-time presentations. Organizations that send regular simulated phishing emails and provide immediate contextual feedback when someone clicks show measurable reductions in click rates over time. Generic annual training sessions have little demonstrated impact on behavior.

How does active learning support cybersecurity awareness training?

Security behaviors are habits, and habits form through practice. When students participate in social engineering role-plays, they experience the psychological pressure of being targeted firsthand. That experience builds the pattern recognition and appropriate skepticism that passive instruction cannot replicate.