Unit 1: Introduction to Security

1. What social engineering looks like (1.1.A)

Many attacks start with a person, not a computer. Social engineering uses psychological tactics to manipulate someone into doing one of three things 1.1.A.1:

It can happen face to face, but it usually arrives by email, text message or social media message 1.1.A.1.

Two tactics show up again and again 1.1.A.2:

• Intimidation: the adversary threatens negative consequences if you do not comply. “Your account will be suspended.”
• Urgency: the adversary gives you a reason to act quickly. “Reply within 10 minutes.”

2. Why the tactics work (1.1.B)

These tactics work because they use common psychological principles that influence everyone 1.1.B.1. One message can use both: a deadline (“today”, “within 10 minutes”) signals urgency, and a loss or punishment (“suspended”, “withheld”, “reported”) signals intimidation.

• Intimidation taps into our natural dislike of bad outcomes. Pointing at a possible loss creates fear, and fear pushes people to act 1.1.B.2.
• Urgency taps into our habit of reacting fast to time-sensitive needs. Under pressure we skip the pause where we would ask, “Is this reasonable? Is this safe?” 1.1.B.3

Detect: when a message makes you feel scared or rushed, treat that feeling as a red flag and slow down. Check through a channel you already trust, such as the official app, instead of the link in the message.

3. What victims can lose (1.1.C)

Try it below on a real-looking email, then on a text message. Some parts are red flags and some are normal.

1. Signs of a password attack (1.2.A)

In an online password attack, the adversary makes login attempts against a device or service, trying common passwords, passwords that follow common patterns, or passwords stolen in earlier breaches 1.2.A.1.

Login records give it away. Watch for these signs 1.2.A.2:

• Many failed attempts in a short time. A person mistypes once or twice. A tool fails dozens of times a minute.
• Logins at unusual times, such as 3 a.m. for a student account.
• Logins from unknown devices the user has never signed in from.

2. How weak passwords get cracked (1.2.B)

People are predictable. Common patterns include 1.2.B.1:

• one or two words, then a two-digit number (often a year), then a special character at the end
• names of family members or pets
• personally significant dates

Adversaries use this. They collect personal details about the target, such as birthdays, anniversaries and pet names, build a dictionary of likely passwords from them, and let an automated tool submit the guesses 1.2.B.2. A public social media profile can hand them most of the list.

# found online: dog "Mocha", born 2008, team "Falcons"
Mocha2008!
mocha08!
Falcons2008!
MochaFalcons08?   # still guessable: both words are public

3. Making authentication stronger (1.2.C)

• Long, random, unique. Every account gets its own password. A password manager can generate and store them, or you can use a long, unique passphrase 1.2.C.1.
• No personal words or numbers. Skip names, dates and anything meaningful to you 1.2.C.2.
• Turn on multifactor authentication (MFA). MFA asks for extra proof of identity, such as a one-time code, on top of the password 1.2.C.3.

Prevent: a passphrase made of several random unrelated words is long and easy to remember. A password manager means you only have to remember one.

New to network names (service set identifiers, SSIDs), access points and beacons? The Networking Basics session on wireless covers them in 10 minutes.

1. Who the adversaries are (1.3.A)

Adversaries can be grouped by skill 1.3.A.1:

Their motivations vary too: greed, desire for recognition, dedication to a cause, revenge, politics or beliefs 1.3.A.2.

2. Three wireless attacks (1.3.B)

3. Protecting yourself on public Wi-Fi (1.3.C)

• Match the name exactly. Confirm the network you join is exactly the one you meant to join 1.3.C.1.
• Think about how sensitive your data is. Most internet protocols are encrypted, but some data, such as domain name system (DNS) queries, can still be exposed. Decide whether your data is sensitive enough to avoid joining unencrypted Wi-Fi 1.3.C.2.
• Consider a virtual private network (VPN). A VPN encrypts all your traffic to the VPN operator’s system, so the network or service provider cannot view it. The trade-off: the VPN provider can 1.3.C.3.

Prevent: a VPN does not remove trust; it moves it. Choose a provider you trust as much as you would trust your internet provider.

1. Six ways adversaries use AI (1.4.A)

Case file: the call from “home”

A student gets a video call. It looks and sounds like their older brother: “I lost my wallet, can you send me the code that just came to your phone?” The face moves naturally. The voice is right. Then the student asks for the family word. The call drops.

2. Protecting against AI-augmented attacks (1.4.B)

• Set up shared secrets with close friends and family: a word or phrase only the two of you know, used to verify identity in high-stakes moments 1.4.B.1.
• Enable multifactor authentication (MFA). If a cloned voice gets past voice authentication, a second factor can still block the login 1.4.B.2.
• Keep personal or sensitive data out of AI tools such as chatbots and virtual assistants. Some tools train on what you type, and adversaries could pull it back out 1.4.B.3.
• Evaluate AI output carefully. Verify it with reputable, stable sources that are not AI-based 1.4.B.4.

Prevent: agree on your shared secret in person, never in a text or chat that could be read later.

1. AI as the defender’s assistant (1.5.A)

The pattern is the same every time: AI suggests, a person who understands the system approves.

# port 22 is remote login; 10.0.5.0/24 means the 256 addresses 10.0.5.0 to 10.0.5.255
# current rule
allow  any  to  server:22   # remote login open to the whole internet
# suggested rule
allow  10.0.5.0/24  to  server:22   # only the admin network
Status: waiting for technician approval

2. Faster, more accurate detection (1.5.B)

• Networks produce millions of digital events every day. A few are probably an adversary at work, and humans cannot inspect them all 1.5.B.1.
• AI tools can be trained to sort events quickly into likely malicious and harmless 1.5.B.2.
• They can be programmed to alert human staff or to take specific corrective actions depending on the type of activity 1.5.B.3.
• The result: teams catch malicious activity and step in quickly, preventing loss, harm, damage and destruction to infrastructure and data 1.5.B.4.

Detect: AI does not replace the logs you will read in Units 3 to 5. It decides which ones a person reads first.