Social engineering: Define the term social engineering.

The idea

Social engineering is the manipulation of people to gain unauthorised access to information or systems, exploiting human psychology rather than technical vulnerabilities. Attackers use deception, persuasion, or impersonation to trick individuals into revealing passwords, transferring funds, or installing malware. Common techniques include phishing emails that appear legitimate, pretexting where an attacker invents a scenario, and baiting with infected USB drives. The key point is that the weakness is human behaviour, not software flaws. Learners should contrast social engineering with technical hacking: it targets trust and authority. A definition must state that it involves manipulating people to breach security, not breaking encryption or code.

What earns the marks

• States that social engineering involves manipulating or deceiving people.
• Specifies that the goal is to gain unauthorised access to information or systems.
• Mentions that it exploits human psychology or trust rather than technical weaknesses.
• Gives a correct example such as phishing, pretexting, or baiting.
• Distinguishes social engineering from technical hacking methods.

Common mistakes and how to put them right

• Describes social engineering as a type of malware or virus.

  Put it right: Clarify that it is a human-based attack.

• Confuses social engineering with brute-force password cracking.

  Put it right: Explain that it relies on tricking the user.

• Omits the element of deception or manipulation.

  Put it right: Emphasise that the attacker actively misleads the victim.

• States that social engineering only occurs via email.

  Put it right: Note that it can happen in person, by phone, or through other media.

Exam tips

• Use the phrase 'manipulating people' in your definition.
• Include a specific technique like phishing to demonstrate understanding.
• Contrast with technical attacks to show you know the difference.
• Keep the definition focused on human behaviour, not software.