Cyber Security Social Engineers - An Extensible Teaching Tool for Social Engineering Education and Awareness

Oct 22, 2026

Uploaded by Eliana

Work in Progress paper presents the design and implementation of an extensible teaching tool targeting social engineering education and awareness. It argues that, although security controls focus heavily on technical mechanisms across application, OS, network, and physical layers, the user layer remains comparatively under-addressed from a sociotechnical standpoint. The approach uses a serious game to teach practical computer security practices, helping users without a technical background defend against common attacks such as phishing and virus hoaxes.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages5

Reading Time13 min

AccessFree to download

Introduction

Cyber security awareness and the user-layer risk

Previous Works

Game-Based Learning

Cyber Security Social Engineers An Extensible Teaching Tool for Social Engineering Education and Awareness Jin-Ning Tioh, Dr. Mani Mina, Dr. Douglas W. Jacobson Department of Electrical and Computer Engineering Iowa State University Ames, IA, USA [jinning@iastate.edu](jinning@iastate.edu), [mmina@iastate.edu](mmina@iastate.edu), [dougj@iastate.edu](dougj@iastate.edu) Abstract—This Work in Progress in the Research to Practice Category paper will discuss the design and implementation of an extensible teaching tool for social engineering education and awareness. With the bulk of recent research within the field of computer and information security being focused squarely on the implementation or theory of security controls and mechanisms atthe application, operating system, network, and physical layers, there has been relatively little attention has been paid to the user layer by contrast, especially from a sociotechnical perspective. Thus, while the technical countermeasures for data security grow increasingly sophisticated, user education and awareness has not kept up by comparison. This leaves them a far more attractive avenue of attack, susceptible to social engineering attacks such as phishing, computer virus hoaxes, and so on. Here then, we will endeavor to present a concise overview of the necessary background as well as discuss some of the design decisions that went into our implementation of an extensible teaching tool in the form of a serious game designed to help instill practical and relevant computer security practices to users who might not necessarily have a technical background, in an effort to guard against some of the more common social engineering attacks. Keywords—serious game; game-based learning; cyber security; social engineering; computer security literacy. I. INTRODUCTION Over the past decade, the meteoric increase of high-profile cyberattacks has certainly highlighted the need for increased cyber security awareness. The WannaCry ransomware attack infected more than 300,000 computers within a period of 4 days, with victims transferring 130,634.77 USD in ransom payments [1] . The Petya cyberattacks on the Ukraine which took place on the eve of its public holiday, Constitution Day, caused the radiation monitoring system at the Chernobyl Nuclear Power Plant to go offline, as well as temporarily cripple several Ukrainian ministries, banks, metro systems and state-owned enterprises [2] . Going even further back, Sony suffered a massive data breach in which the names, addresses and credit card information of 77 million user accounts were compromised in 2011 [3], while the Stuxnet worm deviously sabotaged uranium enrichment in Iran by increasing the wear on and destroying a number of centrifuges [4] . In fact, in 2013, 7% of US organizations lost $1 million or more due to the commission of cybercrimes. The US Director of National Intelligence has even gone so far as to rank cybercrime as the top national security threat, with the FBI notifying 3,000 US companies in 2013 - ranging from small banks, leading retailers, and major defense contractors - that they had been victims of cyber intrusion [5] . Naturally, the body of research related to the implementation or theory of security controls and mechanisms at the application, operating system, network, and physical layers has expanded at a prodigious rate in recent years in response to this growing threat [6] . Yet, despite the recognition of the fact that the user layer continues to be weakest link in the security chain, as well as increased efforts to educate the general public via cyber security awareness campaigns [7], most users continue to adopt an ostrich-like attitude toward the subject, believing there is little they can do on a personal level to take effective precautions, continuing to act without forethought for the consequence of their actions, including visiting unsafe websites, selecting trivial passwords, ignoring warning mes

FAQs

Why does the paper emphasize user education and awareness for social engineering?

It argues that most research and defenses concentrate on technical security controls, while the user layer is a weaker link. This gap makes social engineering attacks such as phishing and virus hoaxes especially effective.

What is the proposed teaching tool in the paper?

The paper presents a prototype of an extensible teaching tool implemented as a serious game. The goal is to instill practical, relevant computer security practices for users who may not have a technical background.

How does the paper justify using game-based learning rather than traditional methods?

It states that a motivation-driven, game-based approach supports successful learning and plans to explain the motivation behind choosing game-based learning. The paper also outlines how the tool will cover stages of a social engineering attack with examples.

Oct 22, 2026

Uploaded by Eliana