Cyber Security Threats and Social Engineering

What Is Cyber Security?

Cyber security is the field concerned with defending digital systems and data. It matters to everyone: a UK bank holding millions of customer accounts, a school storing pupil data, a teenager with a social media profile. Cyber threats do not require physical proximity — an attacker can target a system from anywhere in the world, which is what makes them so difficult to defend against.

Threats come from multiple directions. Some exploit technical weaknesses in software or networks. Others exploit the most unpredictable component of any system: the people using it. Understanding how attacks work is the first step towards defending against them.

Social Engineering

Social engineering targets human psychology rather than technical flaws. Attackers create believable scenarios to trick people into doing something they would not normally do — revealing a password, clicking a link, or unlocking a door. The three forms you need to know are blagging, phishing, and shouldering.

Key Fact

The three social engineering techniques: blagging (pretexting) — creating a fabricated scenario to trick a victim into revealing information; phishing — using fraudulent emails or messages to obtain private information; shouldering — observing someone’s private information over their shoulder, such as watching a PIN being entered at a cashpoint.

Blagging (pretexting) involves inventing a convincing story. An attacker might call a company helpdesk pretending to be an IT contractor who urgently needs a user’s login reset, or claim to be a bank employee asking a customer to “verify” their account details. The invented scenario is designed to create a sense of urgency or authority that overrides the target’s normal caution.

Phishing typically arrives as an email or text message that appears to come from a trusted source — a bank, a delivery company, or a well-known retailer. The message creates urgency (“Your account will be suspended”) and directs the target to a fake website designed to harvest their login credentials. Spear phishing is a targeted form aimed at a specific individual, making the deception more convincing.

Shouldering (shoulder surfing) is the simplest form of social engineering: physically watching someone enter private information. It happens at cashpoints, on public transport when someone reads emails over a stranger’s shoulder, or in an office when someone watches a colleague type a password.

Malware

Malware (malicious software) covers a range of programs designed to cause harm. The three types specified for this course are: computer viruses, trojans, and spyware.

A computer virus attaches itself to an existing file or program. When the infected file is opened or shared, the virus copies itself to other files. Viruses require a host file and rely on user action to spread — for example, opening an infected email attachment or copying a file from an infected USB drive.

A trojan (sometimes called a trojan horse) disguises itself as useful software — a free game, a codec, an update. Once installed, it operates silently in the background. Unlike a virus, a trojan does not self-replicate; instead, it typically opens a back door that allows an attacker to access the infected system remotely.

Spyware runs hidden in the background and monitors the user’s activity. A keylogger is a common form: it records every key pressed, capturing passwords, bank details, and messages. The data is transmitted back to the attacker without the user knowing the software is even present.

Other Threats

Pharming redirects users to a fake website without them clicking any suspicious link. Unlike phishing (which relies on deceiving the user into clicking), pharming tampers with the underlying address resolution process — so even typing a correct bank web address into a browser might lead to a fake copy of that site.

Several other conditions create vulnerabilities. Weak and default passwords are easily guessed or cracked: using “password”, “admin”, or a device’s factory-set password leaves an obvious entry point. Misconfigured access rights occur when users have more permissions than their role requires — for example, a data entry clerk with admin rights could accidentally or deliberately delete critical records. Removable media (USB drives, external disks) can introduce malware when plugged into a device, either deliberately or because the drive was infected elsewhere. Unpatched or outdated software contains known security vulnerabilities that developers have since fixed in updates — systems running old software are exposed to attacks that exploit those known weaknesses.

Penetration Testing

Penetration testing is a defensive technique: organisations hire specialist testers to attack their own systems legally and intentionally. The goal is to discover weaknesses before a malicious attacker does. There are two key approaches: