AQA · GCSE · Computer Science
Course version: 8525 · Version from Sept 2020
Describe what social engineering is and how it can be protected against.
Full specification wording
Social engineering: Describe what social engineering is and how it can be protected against.
Social engineering is the manipulation of people into revealing confidential information or performing actions that weaken security, by exploiting trust, authority, urgency or curiosity rather…
Checked against the AQA 8525 specification (opens in a new tab) on .
- Point 3 of 10
Study notes
From the checked teaching notes for this specification point.
The idea
Social engineering is the manipulation of people into revealing confidential information or performing actions that weaken security, by exploiting trust, authority, urgency or curiosity rather than technical flaws. A typical attack is a phone call from someone claiming to be IT support who asks a user to confirm a password, or an email urging a user to click a link and log in. Protection focuses on the human layer: staff training and awareness so people question unexpected requests, verifying identity through a separate trusted channel, following clear security policies, and reporting suspicious contact. Technical measures such as filtering, multi-factor authentication and access controls reduce the harm when a person is deceived.
What earns the marks
- Defines social engineering as manipulating people into revealing information or taking unsafe actions, exploiting human trust rather than software vulnerabilities.
- Identifies a realistic method, such as a phone call impersonating IT support, a phishing email or a request to reset credentials.
- Explains a protection through people: training and awareness so users question unexpected requests and verify identity.
- Explains a protection through process or technology: security policies, reporting routes, filtering, multi-factor authentication or access controls limiting the damage.
Common mistakes and how to put them right
Treating social engineering as a purely technical attack such as a virus.
Put it right: It targets human behaviour and trust.
Assuming antivirus alone prevents it.
Put it right: Training, verification and policy are central, with technical controls as support.
Giving only a definition with no protection measure.
Put it right: The question asks for both what it is and how to protect against it.
Exam tips
- State the definition in one clear sentence before giving examples.
- Link each protection to the specific human weakness it addresses.
- Use a concrete scenario, such as a caller claiming to be IT support, to show understanding.
Try the lesson
The start of the Social engineering: Describe what social engineering is and how it can be protected against. lesson, made from checked teaching notes for this specification point.
Have a go first
What is the main target of a social engineering attack?
There is more to this lesson
The full lesson goes on to check your understanding and help you earn the marks. Create a free account to carry on, with your progress saved.
A week of Premium from your first lesson · Then the free plan continues · No card, no charge
Test your understanding of Social engineering: Describe what social engineering is and how it can be protected against.
Active recall beats re-reading. Take an instant quiz now to test what you’ve learned and lock it into long-term memory.
A week of Premium from your first lesson · Then the free plan continues · No card, no charge