Discussion: Social engineering threats, awareness and defense (“Killing with Keyboards”)
Social engineering attacks exploit human psychology rather than technical vulnerabilities. The Killing with Keyboards slideshow showcases a social engineering attack that led to a tragic loss of life. Discuss the multifaceted nature of social engineering threats and effective strategies for awareness and defense, with APA references:
- What are some common methodologies employed in social engineering attacks?
- How has social engineering evolved over time?
- How significantly do awareness and education programs contribute to prevention?
- What strategies do individuals and organizations use to prevent and reduce the risk of social engineering, and how effective have they proven in real-world scenarios?
Awareness, simulations, a culture of reporting
Out-of-band verification, dual approval, least privilege
Phishing-resistant MFA, email filtering, reporting buttons
Model discussion post
Original example for study purposes (about 750 words). Add one or two specific details from the Killing with Keyboards slideshow.
Social engineering is the manipulation of people into revealing information, granting access or taking actions that benefit an attacker. Its power lies in exploiting trust, fear, urgency, authority and helpfulness rather than software flaws. The consequences can be fatal. In the 2017 Wichita “swatting” case, for example, a dispute over an online game led a caller to make a fake hostage report to police; officers responding to the address shot and killed Andrew Finch, an uninvolved man, and the caller was sentenced to 20 years in federal prison (Chalk, 2019). Cases like this, and the one in the slideshow, show that manipulating people and institutions with nothing more than a keyboard or a phone can cause real-world harm.
Common Methodologies
Salahdine and Kaabouch (2019) classify social engineering attacks as human-based or computer-based and as direct or indirect. Common methods include:
- Phishing (mass deceptive emails), spear phishing (targeted messages) and whaling (targeting executives).
- Vishing and smishing: voice calls and text messages impersonating banks, IT help desks or government agencies.
- Pretexting: inventing a believable scenario, such as posing as a vendor or new employee, to obtain information.
- Business email compromise (BEC): impersonating executives or suppliers to redirect payments.
- Baiting and quid pro quo: offering free downloads, infected USB drives or “tech support” in exchange for access.
- Physical tactics: tailgating into secure areas, shoulder surfing and dumpster diving.
- Swatting, doxxing and sextortion: manipulating emergency services or victims themselves, often with devastating personal consequences.
How Social Engineering Has Evolved
Early social engineering relied on phone calls and in-person deception, famously used by hackers such as Kevin Mitnick to talk employees into revealing passwords. Email brought mass phishing in the late 1990s and 2000s, followed by targeted spear phishing that used information from social media to make messages believable. Today, attacks are multichannel and increasingly powered by artificial intelligence. In 2024, an employee at the engineering firm Arup in Hong Kong transferred about $25 million in 15 transactions after joining a video call with deepfake versions of the company’s chief financial officer and colleagues (Prakash, 2024). Generative AI now produces fluent, error-free phishing messages and cloned voices, removing the spelling mistakes users were once taught to look for. Attackers have also shifted from stealing data to stealing money directly: the FBI’s Internet Crime Complaint Center received 193,407 phishing and spoofing complaints in 2024, and BEC alone caused about $2.77 billion in reported losses, within a record $16.6 billion in total cybercrime losses (Proofpoint, 2025).
The Role of Awareness and Education
Awareness programs are necessary but not sufficient. The human element remains involved in about 60% of breaches (Verizon, 2025), so employees who recognize manipulation are a critical line of defense. However, research shows that the design of training matters. In a 15-month study of more than 14,000 employees, Lain et al. (2022) found that voluntary “embedded training,” which redirected employees to a training page after they clicked a simulated phish, did not reduce susceptibility and may have created overconfidence; trained employees were actually slightly more likely to click later phishing emails. The same study found that crowdsourced reporting worked well: employees reported suspicious emails quickly and consistently, and their reports helped detect 252 real phishing campaigns. The lesson is that education should build habits, such as pausing, verifying and reporting, and create a blame-free culture, rather than relying on one-time modules or punitive click tests.
Prevention Strategies and Their Effectiveness
- Verification procedures: requiring call-back verification through a known number and dual approval for payment changes directly counters BEC and deepfake fraud; the Arup loss might have been prevented by an independent check with headquarters before the first transfer.
- Phishing-resistant multifactor authentication: hardware keys or passkeys prevent stolen passwords from being used, although attackers increasingly target weaker MFA through push-notification fatigue.
- Technical controls: email authentication (SPF, DKIM and DMARC), filtering, link sandboxing and endpoint protection reduce the number of malicious messages that reach users.
- Least privilege and segmentation: limiting what any single compromised account can access reduces the impact of successful attacks.
- Reporting culture and incident response: one-click reporting and rapid response turn employees into sensors, as Lain et al. (2022) demonstrated.
- Individual protection: limiting personal information online, privacy settings, skepticism toward urgent requests and, for swatting risk, registering with local police where programs exist.
In real-world practice, the most effective approach is layered. No single control stops every attack, but combining people, process and technology makes social engineering much harder and less profitable. Organizations that pair realistic, supportive training with strong verification procedures and phishing-resistant authentication consistently reduce losses, while organizations that rely on awareness alone remain vulnerable to the next convincing message.
References
Chalk, A. (2019, March 29). Man responsible for fatal 2017 swatting sentenced to 20 years in jail. PC Gamer. https://www.pcgamer.com/man-responsible-for-fatal-2017-swatting-sentenced-to-20-years-in-jail/
Lain, D., Kostiainen, K., & Čapkun, S. (2022). Phishing in organizations: Findings from a large-scale and long-term study. In 2022 IEEE Symposium on Security and Privacy (pp. 842–859). IEEE. https://doi.org/10.1109/SP46214.2022.9833766
Prakash, P. (2024, May 17). A deepfake “CFO” tricked the British design firm behind the Sydney Opera House in $25 million scam. Fortune. https://fortune.com/europe/2024/05/17/arup-deepfake-fraud-scam-victim-hong-kong-25-million-cfo/
Proofpoint. (2025). Email attacks drive record cybercrime losses in 2024. https://www.proofpoint.com/us/blog/email-and-cloud-threats/email-attacks-drive-record-cybercrime-losses-2024
Salahdine, F., & Kaabouch, N. (2019). Social engineering attacks: A survey. Future Internet, 11(4), 89. https://doi.org/10.3390/fi11040089
Verizon. (2025). 2025 data breach investigations report. https://www.verizon.com/business/resources/reports/dbir/
Make it yours: open your post with the specific incident from the slideshow, explain which social engineering method was used and identify which prevention strategy would most likely have stopped it.
Frequently asked questions
What is the difference between phishing and pretexting?
Phishing uses deceptive messages, often sent widely, to get a victim to click or share information. Pretexting builds a fabricated scenario and identity to persuade a specific person to cooperate.
Does security awareness training work?
It helps when it builds reporting habits and a supportive culture, but studies show some formats, such as voluntary embedded training after a failed simulation, have little or no effect on their own.
More model assignments posted today
- Terrorism and neutralization techniques
- GEN 103 information literacy project
- Adolescent sexual risk and sex education
- APN decision-making and leadership essay
- NURS 6050 HRRP policy evaluation template