Social Engineering — Hacking the Human

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand social engineering — hacking the human — without any of the intimidation
Apply this concept right away in real-world scenarios
Learn to avoid security risks for both yourself and others

Let's think about this for a second

Pretexting — the attacker poses as IT support, a boss, or a vendor to request information (for example, 'This is IT, we need to verify your password'). Baiting — dangling a 'free USB drive' or an attractive download to plant malware. Tailgating — following an authorized person into an office building. CEO fraud/Business Email Compromise — posing as the CEO to demand an urgent wire transfer.

Let's connect this to a real scenario

If someone calls claiming to be 'IT Support' and asks for your password — real IT support will never ask for your password over the phone or email. If you get a sensitive request (a money transfer, a password, access), call back through an official channel (a number you look up yourself) to verify — never use the number the caller gave you (it could be fake).

Able to distinguish pretexting, baiting, tailgating, and CEO fraud
Never give out passwords or sensitive info over phone or email
Verify urgent requests through an official channel

Let's walk through it together

text

Social engineering red flags
-----------------------------
"ကျွန်တော် IT ကနေပါ, password confirm ဖို့လိုပါတယ်"
"CEO က urgent wire transfer တောင်းနေပါတယ်, ဒီနေ့ပဲ လုပ်ပေးပါ"
"ဒီ USB drive ကို free ဖြန့်ဝေနေပါတယ်"

You should see

You'll be able to distinguish four social engineering techniques and describe a defense for each.

Try it in 5 minutes

Write your own scenario where someone poses as a 'boss' or 'IT support' with an urgent request, then write down how you should respond.

A quick word of caution

Never use a 'callback number' the attacker gives you — look up the number yourself from the company's official website and verify it.

Easy traps

Complying with a caller who claims authority without asking any questions
Acting under urgency pressure without verifying first

Now try it yourself

Write your own scenario where someone poses as a 'boss' or 'IT support' with an urgent request, then write down how you should respond.

You'll know it worked when: You'll be able to distinguish four social engineering techniques and describe a defense for each.