Cyber security threats: social engineering techniques

The idea

Social engineering means manipulating people into giving away information or access, rather than attacking hardware or software directly. The attacker exploits trust, urgency or authority. Common techniques include phishing (fake emails or messages that push a victim to reveal credentials or click a malicious link), pharming (redirecting a user to a fraudulent website, often via altered DNS or a compromised host file), blagging (inventing a plausible story to persuade someone to disclose data), shouldering (watching a screen or keypad to learn a password or PIN) and using a false identity to gain trust. Because the weakness is human behaviour, technical defences alone are limited; staff training, verification procedures and caution reduce risk.

What earns the marks

• Social engineering targets people and their trust rather than technical vulnerabilities.
• Phishing uses fraudulent messages to trick a recipient into revealing data or clicking a malicious link.
• Pharming redirects a user to a fake website, for example through altered DNS records or a compromised host file.
• Blagging uses a fabricated story to persuade someone to disclose information.
• Shouldering is observing a screen or keypad to obtain a password or PIN.
• Prevention relies on user awareness, verification of identity and caution, not only on software defences.

Common mistakes and how to put them right

• Thinking social engineering is a software exploit.

  Put it right by stressing that the attacker manipulates a person's trust or behaviour.

• Confusing phishing with pharming.

  Put it right: Phishing uses a deceptive message to lure the victim, whereas pharming redirects the victim to a fraudulent site without needing a lure.

• Assuming antivirus alone prevents social engineering.

  Put it right by noting that user training and verification procedures are central defences.

Exam tips

• Learn each named technique with a one-line definition and a short example so you can match it to a scenario.
• When a question gives a scenario, identify the human weakness being exploited before choosing the technique.
• Use precise vocabulary such as phishing, pharming, blagging and shouldering rather than a vague 'hacking'.