Chapter 5 — Security literacy | Technologist Human factors and cyber policy

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Security literacy

Lesson map

Lesson 05 published. Map, example, EX013.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 Common techniques"]
  N2["5.2 Why people fall for them"]
  N3["5.3 Role of awareness"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX013"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 Common techniques"]
  N2["5.2 Why people fall for them"]
  N3["5.3 Role of awareness"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX013"]

[Learning outcomes]
    |
    v
[5.1 Common techniques]
    |
    v
[5.2 Why people fall for them]
    |
    v
[5.3 Role of awareness]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX013]

Learning outcomes

You will (1) explain common social engineering techniques; (2) describe why people fall for them; (3) explain the role of awareness guidance.

5.1 Common techniques

Lucas studies techniques described in Hadnagy (2018): phishing emails, phone pretexting and impersonation. At Brightwell, the most likely attacks are fake supplier invoices, fake login pages for the booking system and calls pretending to be from the practice management vendor asking for remote access. He writes short descriptions of each with synthetic examples so that colleagues can recognise the patterns without being exposed to real malicious content. He shares the descriptions at a team meeting, where receptionists add two examples of calls they have received, which he rewrites without any identifying details.

5.2 Why people fall for them

Cialdini (2021) describes principles of influence such as authority, urgency, scarcity and liking. A vendor call claiming a system will stop working within an hour unless a receptionist grants remote access uses authority and urgency. Lucas notes that receptionists are trained to be helpful and quick, which attackers exploit. Falling for such a call reflects normal, useful habits used against people, not stupidity. This understanding shapes his later work on verification procedures that relieve staff of making these judgements alone. Marta agrees.

5.3 Role of awareness

NIST SP 800-50r1 (Hansche et al., 2024) describes awareness as one part of a learning programme alongside role-based training. Lucas sees that awareness can help staff recognise patterns, but Bada, Sasse and Nurse (2019) warn that awareness alone rarely changes behaviour. He concludes that Brightwell needs both brief awareness and practical procedures, such as calling vendors back on known numbers, so that staff know what to do, not just what to fear. He writes this conclusion into his placement report and discusses it with the practice manager, who agrees to trial both approaches together.

Worked example

Lucas describes likely attacks at Brightwell, explains them with Cialdini's principles and positions awareness alongside procedures.

Synthetic case. Examples are synthetic; Hadnagy (2018), Cialdini (2021), SP 800-50r1 and Bada et al. (2019) are real.

Errors and limits

Attack types change. Awareness fades.

Exercises

EX013 — Vendor call principles. Which influence principles does the fake vendor call use? Rubric: 3 = authority and urgency;; 2 = two;; 1 = liking;; 0 = none.
EX014 — Habits exploited. Which staff habits do attackers exploit? Rubric: 3 = being helpful and quick;; 2 = helpfulness;; 1 = vague;; 0 = none.
EX015 — Awareness plus. What must accompany awareness? Rubric: 3 = practical procedures such as callbacks;; 2 = procedures;; 1 = vague;; 0 = none.

Synthesis

Security literacy explains techniques and why they work, and pairs awareness with procedures.

Continue studying — chapter 05 of 30

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →