Workshop 03 · Security Awareness

Spot the Trap Before You Click

Phishing, weak passwords, and social engineering: the human side of security. Learn the warning signs attackers rely on you to miss.

What You’ll Practice

The human attack surface is the one no firewall covers. Recognising the pattern is the whole defence.

Phishing Recognition

Sender addresses, urgency, mismatched links, and the small details that separate a real message from a forged one.

Password Hygiene

Why length beats complexity, what reuse costs, and how quickly a weak password falls to a wordlist.

Social Engineering

Pretexting, baiting, and tailgating — manipulation that never touches a technical control.

Lesson 1 · AWR-01

Spotting a Phishing Email

Phishing is a message that pretends to come from someone you trust so that you click a link, open an attachment, send money, or hand over your password. It targets people, not software, so no firewall stops it.

How it works

Most phishing combines a few recognisable moves. Check the actual sender address, not just the display name. Hover over links before clicking to see the real destination. Be suspicious of urgency (“within 24 hours”) and of any request for your password, which a real IT desk never needs. 

From: "University IT Desk" <[email protected]>      ← not the university domain
Subject: Your account closes in 24 hours                 ← urgency
Link text: portal.university.edu
Real link: http://portal-university.verify-login.co       ← look-alike domain

How it is prevented

  • Verify unexpected requests through a channel you already trust, such as the official website or a known phone number.
  • Report suspicious messages to IT instead of deleting them, so others are warned.
  • Turn on multi-factor authentication, so a stolen password alone is not enough.

Lesson 2 · AWR-02

Passwords That Survive an Attack

Attackers rarely guess passwords one by one by hand. They run wordlist attacks: millions of real passwords from earlier breaches, plus common variations, tried automatically.

How it works

Swapping letters for look-alike symbols (P@ssw0rd) or adding a year and an exclamation mark (Summer2026!) are the first variations cracking tools try. What makes a password hard to crack is mostly length and unpredictability: a passphrase of several random words beats a short “complex” password. 

P@ssw0rd123                          ← in every wordlist, with variations
correct horse battery staple river   ← long, random words: far harder to guess

How it is prevented

  • Use long passphrases, and a password manager so every account gets a different one.
  • Turn on multi-factor authentication wherever it is offered.
  • NIST guidance asks services to allow long passwords, check new passwords against lists of breached ones, and drop arbitrary composition rules.

Lesson 3 · AWR-03

Social Engineering by Phone

Social engineering manipulates people into giving away access. On the phone (vishing), an attacker invents a believable pretext, such as a new IT contractor, an auditor, or a stressed manager, and relies on politeness and urgency.

How it works

A skilled caller rarely asks for a password. They collect small, harmless-sounding facts (your manager’s name, your date of birth, your first pet, which systems you use) and combine them to pass account-recovery questions or to sound convincing on the next call. 

"Hi, I'm with the IT contractor doing the email migration. Just confirming
 your details: you report to Ms. Al-Harbi, right? And your date of birth
 for the record?"    ← each answer sounds harmless; together they reset an account

How it is prevented

  • Verify callers by calling back on a number you look up yourself, never one they give you.
  • Treat personal details as security information: they are often account-recovery answers.
  • Help desks need a fixed verification procedure that does not bend for urgency.

What You Take Away

Awareness is a habit rather than a tool, and it is the control that scales to every employee.

  • Verify through another channel

    If a request is unexpected, confirm it using contact details you already had, never the ones in the message.

  • Urgency is the warning sign

    Pressure to act immediately is the most reliable indicator of a social engineering attempt.

  • Use a manager and MFA

    Unique long passwords plus a second factor mean one stolen credential does not open everything.

  • Report, do not just delete

    Reporting a phishing attempt protects colleagues who received the same message.

Sources

  1. US Department of Justice. (2019, March 20). Lithuanian man pleads guilty to wire fraud for theft of over $100 million in fraudulent business email compromise scheme. https://www.justice.gov/usao-sdny/pr/lithuanian-man-pleads-guilty-wire-fraud-theft-over-100-million-fraudulent-business
  2. CISA. (n.d.). Recognize and report phishing. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing
  3. National Institute of Standards and Technology. (2017). SP 800-63B: Digital identity guidelines, authentication and lifecycle management. https://pages.nist.gov/800-63-3/sp800-63b.html
  4. TechCrunch. (2009, December 14). RockYou hack: From bad to worse. https://techcrunch.com/2009/12/14/rockyou-hack-security-myspace-facebook-passwords/
  5. New York State Department of Financial Services. (2020). Twitter investigation report. https://www.dfs.ny.gov/Twitter_Report

Ready to put it into practice?

Try the Security Awareness challenges: capture the flags, score points, and unlock the explanation for each one.

Start the Security Awareness challenges Next workshop: Cybersecurity Ethics