Social Engineering

Instead of finding a software bug, the attacker invents a believable story — or uses fear, authority, urgency, curiosity, or helpfulness — so the victim performs the risky action themselves. It is often cheaper and more reliable than breaking cryptography. The "exploit" is a decision under pressure: type the password, open the attachment, approve the transfer, hold the door. Defenders who only patch servers and ignore humans leave the cheapest door unlocked.

Pause-and-verify is the core defensive mechanism. Urgency collapses the window in which careful checking fits. Authority makes challenge feel rude. Helpfulness makes "reset this for a colleague" feel kind. Your counter is not rudeness for its own sake. It is a second channel you already trust: the official app, a number on the card, a walk to the desk, a callback you initiate. If the only way to "save" the situation is to comply inside the suspicious channel, the situation is the attack.

Phishing is social engineering delivered as a message — email, SMS, chat, sometimes QR. The sender impersonates a trusted brand or person so you open a link, type credentials on a lookalike page, run a file, or move money. Spear phishing is the researched variant aimed at one person or role (finance, HR, CEO assistant). Mass phishing sprays; spear phishing invests in personalization. Either way, the defensive move is the same: do not authenticate through the message's link. Navigate yourself.

Pretexting is the crafted identity and story: "I'm IT support; I need your password to fix the VPN," "I'm from the bank fraud unit; read me the code we just texted you," "I'm a new contractor; can you badge me in?" The story is the weapon. Real IT and real banks almost never need your password or a live MFA code read aloud. Real visitors have processes that do not depend on your politeness alone. Ask for a ticket number, call the published IT line, or escort the person to reception — never invent access for a stranger because the story was smooth.

Baiting uses a tempting object or offer — a USB labeled "Payroll 2026" in a parking lot, a "free gift card" page, a too-good download. Curiosity and greed beat caution. The defensive rule is absolute for work systems: never plug unknown media into a corporate PC; never run unexpected installers from strangers. At home, the same instinct protects you: unknown USBs are not toys. If you find one, turn it in to security or discard it safely — do not "just see what files are on it."

Tailgating (piggybacking) is physical social engineering: following an authorized person through a badge door, smiling with a full coffee tray so you hold the door, claiming "I forgot my badge." Courtesy becomes the bypass for physical access controls. Defenders: badge yourself only; politely redirect visitors to reception; do not argue in the doorway — use the process. Physical access often becomes digital access: unlocked machines, printer trays, unattended USB ports. Module 1's screen lock still matters after the door.

Urgency and fear ("account closes in one hour," "police warrant") shrink working memory so verification feels impossible. Authority ("CEO," "fraud unit") borrows rank so challenge feels career-risky. Curiosity and greed ("confidential salaries.pdf," "you won") make the click feel like a win. Helpfulness ("help a locked-out coworker") turns kindness into the exploit. Naming the trigger is how you slow down. You are not "dumb" for feeling them — you are human. The discipline is noticing the feeling and switching channels before you comply.

Practice triage on messages you already received. Do not visit suspicious URLs. Do not send test phishes. The drill is classification and second-channel habit — the same pause you will need when the lure is personalized by AI.

When a message asks for login, money, or codes:
1. Pause — urgency is a red flag (mechanism: collapse verification time)
2. Check display name AND real address/domain carefully
3. Hover (desktop) or long-press (mobile) links — do NOT tap yet
4. Open a NEW tab/app and go to the official site yourself
5. Never give passwords or one-time codes to someone who called YOU
6. For money requests: verify on a second channel (saved number / family code)
7. Unknown USB labeled "Payroll" / "Confidential" → do NOT plug in

mkdir -p "$HOME/cyberlium-lab"

You now recognize phishing, pretext, baiting, and tailgating as mechanisms — and you practiced slowing down. Next is the Module 1 quiz — Foundations of Security — to lock in CIA, 2026 threats, actors, ethics, and social engineering before Module 2 deepens each CIA pillar.