Social engineering, e.g. phishing, people as the 'weak point'

Forms of attack: Social engineering, e.g. phishing, people as the 'weak point'

1.4.1 Threats to computer systems and networks

Threats to computer systems and networks — Note 3 of 7

What you need to know

Social engineering is the art of manipulating people into revealing confidential information. It exploits human psychology rather than technical vulnerabilities — people are often the 'weak point' of security.

What to know

People are considered the 'weak point' of security because they can be tricked, unlike firewalls or encryption.

Key terms

Exam tipCommon mistake

Social Engineering: Manipulating people into giving up confidential information by exploiting human trust and psychology.
Exam tip: Social engineering attacks target PEOPLE, not technology. The weakness is the HUMAN, not the computer system.
Phishing: A social engineering technique where fraudulent emails or messages are designed to look like they come from a reputable source (e.g. a bank) to trick victims into revealing personal information.
Phishing typically contains a link to a fake website that looks legitimate, tricking users into entering login details or personal data.
Common mistake: Describing phishing as 'hacking'. Phishing is a form of social engineering — it tricks people rather than exploiting technical vulnerabilities.
Pharming: Redirecting a user to a fake website (via malware or DNS poisoning) where they unknowingly enter personal data.
Shoulder Surfing: Watching someone enter their password or personal information by looking over their shoulder.

Ready to test yourself?

Practise 1.4.1 questions

← Previous noteMalware1.4.1 Threats to computer systems and networks Next note →Brute-force attacks1.4.1 Threats to computer systems and networks

Back to Threats to computer systems and networks

Revise another OCR GCSE topic: Identifying and preventing vulnerabilities