Psychological manipulation of people to trick them into making security mistakes or revealing information.
Social engineering exploits human psychology rather than technical vulnerabilities. Attackers manipulate victims through trust, fear, urgency, authority, or helpfulness to bypass security controls. Social engineering underlies most cyber attacks—phishing emails, vishing calls, and physical intrusion attempts all rely on deceiving people. Common techniques include impersonation, pretexting (creating fabricated scenarios), baiting, and tailgating. Technical controls alone cannot prevent social engineering; security awareness and healthy scepticism are essential.
Why It Matters
The DSC Perspective:
Social engineering bypasses technical security by targeting people. The most sophisticated security tools can't stop an employee from willingly handing over credentials or approving a fraudulent payment. Awareness training is your primary defence.