Cyber Security and Digital Currency: Question 8
Syllabus 5.3
A caller phones the finance department of a company, claiming to be from the IT helpdesk and stating that a routine security check is underway. The caller asks the employee to confirm their username and read out their password "to verify the account", explaining that the account will otherwise be locked within the hour. Wanting to avoid being locked out, the employee reads out the password. No malicious code or software is used at any point in this incident.
(a) State the cyber security threat being described. [1]
(b) Explain why this incident is classified as this threat rather than as hacking. [2]
(c) Give two measures, other than warning this one employee personally, that the company could put in place to reduce the risk of staff being tricked in this way in future. [2]
Show worked solution Hide worked solution
Worked solution
Part (a): Naming the threat
No malicious code or software is involved at any point. The employee is manipulated into voluntarily reading out their own password over the phone, after being told a false story about a security check and an urgent deadline. This direct manipulation of a person, rather than a technical attack on a system, is social engineering.
Part (b): Why this is social engineering rather than hacking
Hacking involves gaining unauthorised access to a system through technical means, such as exploiting a vulnerability in software, bypassing a login screen, or using stolen credentials to log in directly. None of that happens here: the attacker never touches the company’s systems or writes any code. Instead, the whole incident relies on the caller convincing the employee, through a false identity and a false sense of urgency, to hand over the password of their own accord. Because the “way in” is deception of a person rather than exploitation of technology, this is social engineering rather than hacking.
Part (c): Reducing the risk in future
- Staff training/awareness: teaching all employees, not just the one involved, to recognise social engineering tactics such as false urgency and impersonation, and to never reveal a password to anyone over the phone.
- A clear “never ask for a password” policy: if staff know that genuine IT support will never ask for a password directly, any call that does so is immediately recognisable as suspicious.
- Independent verification of callers: staff hang up and call the IT department back using a known official number before discussing any account details, so an attacker cannot rely on staff trusting an incoming call at face value.
Any two of these reduce the risk without relying on warning only the one employee who was targeted.
Final answers
- (a) Social engineering
- (b) No technical exploit or unauthorised system access is used; the attacker manipulates the employee directly into voluntarily giving away the password, which is what makes it social engineering rather than hacking.
- (c) Any two of: staff training/awareness; a policy that IT will never ask for a password; independent verification of the caller’s identity.