Understanding Social Engineering
Introduced| English |
|---|
| person/ˈpɜːsn/ |
| social engineering/ˈsəʊʃl ˌendʒɪˈnɪərɪŋ/ |
| adversary/ˈædvəsəri/ |
| elicitation/ɪˌlɪsɪˈteɪʃn/ |
| intimidation/ɪnˌtɪmɪˈdeɪʃn/ |
| urgency/ˈɜːdʒənsi/ |
| impersonate/ɪmˈpɜːsəneɪt/ |
| one-time password/wʌn taɪm ˈpæswɜːd/ |
| malware/ˈmælweə/ |
Fooling the human, not the code
- The weakest part of a system is often the person using it.
- Social engineering 社会工程学 tricks people into breaking security.
- The attacker — the adversary 对手 — fools a person instead of hacking the machine.
How it reaches you
- Most attacks come by email, text, or social media.
- The goal is elicitation 套取信息 — getting secrets out of you.
- It can also happen in person or over the phone.
Which social-engineering tactic is it?
Intimidation threatens harm; urgency invents a deadline; consensus claims everyone else acted; authority borrows power.
What is the main goal of social engineering?
Social engineering targets the human, not the code.
"Reply in the next 10 minutes or lose access" mainly uses which tactic?
A tight deadline creates urgency.
Which are common social-engineering pressure tactics? (Choose all)
Encryption is a defense, not a pressure tactic.
Two powerful feelings
- Intimidation 恐吓 threatens a bad result so fear makes you obey.
- Urgency 紧迫感 invents a deadline so you act without thinking.
- Other tactics: authority, consensus, scarcity, familiarity.
When a message makes you feel rushed or scared, slow down. That feeling is exactly the pressure an adversary wants — stop and check before you click or reply.
Giving an adversary your pet's name and birthday could help them impersonate you.
That info often answers security challenge questions.
Secret software that steals data after you click a bad link is called ____.
Malware = malicious software.
Match each tactic to its trick.
Each tactic exploits a different human instinct.
What the victim loses
- They may reveal personal info used to impersonate 冒充 them.
- They may hand over a one-time password (OTP) 一次性密码.
- They may download malware 恶意软件 that steals data.
An email says: "Your account will be locked in 1 hour — click here to verify." That single sentence uses urgency (1 hour) and intimidation (locked). Both push you to click before thinking.
Social engineering attacks the human with psychological pressure — mainly intimidation and urgency — to make a victim reveal secrets, hand over a password, or run malware. The defense is to slow down and verify.