Exploring Social Engineering

Overview

Duration: 90 minutes
Class Size: 1 student
Unit: Cyber Security Essentials (Lesson 3 of 5)
National Curriculum Alignment:

• Computing Programme of Study KS4 (Years 10–11)
• Focus on National Curriculum aims: "Understand the principles of information security, and how cyber security can impact individuals and organisations."
• Relevant references:
  • Computing - Key Stage 4 section on “Computer systems and networks”: Understand methods of securing networks and devices.
  • Computing - Key Stage 4 section “Data and Information”: Understand the risks and ethical issues around cyber security.

---

Learning Objectives

By the end of this lesson, the student will be able to:

1. Define social engineering and explain its significance in cyber security. (NC reference: Knowledge of threats and vulnerabilities within UK National Curriculum Computing KS4)
2. Identify and describe key social engineering techniques: blagging, phishing, and shouldering.
3. Analyse real-life scenarios and recognise how social engineering tactics are employed.
4. Develop effective strategies to protect personal and organisational information from social engineering attacks.

---

Resources Needed

• Laptop or tablet with internet access (for videos and interactive scenarios)
• Whiteboard or notebook for notes and diagrams
• Printed or digital case studies/examples of social engineering attacks
• Role-play cards for blagging/phishing scenarios
• Cyber security awareness poster templates

---

Lesson Structure

1. Starter Activity (10 mins) – What is Social Engineering?

• Engage student by asking: "Have you ever received an unexpected email or phone call asking for personal information?"
• Briefly discuss experiences and perceptions.
• Introduce the formal definition of social engineering: “Manipulative techniques used by attackers to trick people into giving away confidential information.”
• Draw a mind map of the term with student input, noting synonyms like deception, manipulation, and trust abuse.

National Curriculum Alignment: Encourages critical thinking about cyber threats as stipulated in KS4 Computing.

---

2. Main Activity Part 1 (25 mins) – Exploring The Techniques

• Using a detailed PowerPoint or interactive presentation, explain and define:

  • Blagging: Pretending to be someone else to obtain restricted info.
  • Phishing: Fraudulent emails/websites that mimic legitimate sources to gain sensitive data.
  • Shouldering: Physically observing someone’s private info, e.g., passwords or PINs.

• For each technique, show real-world UK examples (e.g., NHS phishing scams).

• Show a short, engaging video animation demonstrating each method.

Activity: Student creates a comparison table outlining each technique, its method, and impact.

National Curriculum Alignment: Meets the requirement to analyse cyber security threats and preventive methods.

---

3. Main Activity Part 2 (25 mins) – Scenario Analysis & Role-Play

• Present 3 brief scenarios illustrating blagging, phishing, and shouldering in everyday life (e.g., a phone scam at a bank, fake email from a shop, shoulder-surfing at an ATM).

• Role-Play: Student acts as both attacker and target in simulated blagging and phishing attempts using role-play cards to immerse in the experience.

• Discuss red flags and how they felt in each role.

• Debrief: Summarise key behaviours to recognise and question during such attempts.

National Curriculum Alignment: Aligns with the National Curriculum focus on understanding cyber security threats and developing responsible attitudes to technology.

---

4. Consolidation Activity (20 mins) – Protective Strategies

• Brainstorm and list strategies to protect against these social engineering attacks, such as:

  • Verifying caller identity
  • Hovering over links before clicking
  • Covering keypads/PINs when inputting
  • Using multi-factor authentication

• Student then designs an original cyber security awareness poster aimed at peers, warning against social engineering scams, integrating the techniques and protective advice learned.

• Discuss how awareness and education can reduce the human factor vulnerability.

National Curriculum Alignment: Develops understanding of security measures and promotes digital literacy as per national computing aims.

---

5. Plenary & Assessment (10 mins)

• Student summarises what social engineering is and lists at least two protective strategies aloud or in writing.

• Teacher asks targeted questions to check understanding, e.g.,:

  • “What is the main difference between phishing and blagging?”
  • “How can you protect yourself from shouldering?”

• Quick recap quiz (verbal or written) with 5 questions related to lesson content.

Assessment: Formative assessment of student’s conceptual grasp and ability to apply knowledge through questioning, discussion, and poster creation.

---

Extension/Homework (Optional)

• Research and write a paragraph about a recent social engineering attack in the UK media, describing the technique used and the outcome.
• Reflect on what could have prevented that attack.

---

Differentiation & Personalisation

• Individualised pace given 1:1 setting; can deepen discussion or provide simpler examples as needed.
• Use tech tools (interactive simulations) for kinaesthetic learning.
• Posters allow creative expression to reinforce retention.

---

Reflection Notes for Teacher

• Monitor how well the student grasps the conceptual difference between social engineering and technical hacking.
• Adjust role-play complexity according to student's confidence.
• Use student’s poster design as an ongoing reference point to revisit lessons on cyber security throughout the unit.

---

This lesson provides a balanced blend of theory, practical activities, and creative work to engage a GCSE student deeply in understanding social engineering within the framework of England’s National Curriculum Computing KS4 programme.