Social Engineering Prevention

Social engineering is the art of getting people to do what an attacker wants: hold a door, reset a password, read out a code, plug in a drive, share a shipping schedule or let a stranger into the stockroom. It needs no malware. It needs a convincing story and a person who wants to be helpful. At a defense supplier, that story is aimed at controlled unclassified information, export-controlled drawings, payments and physical access to the shop floor.

This course shows you how the manipulation works, from the psychology attackers rely on to the full attack cycle of research, approach, exploitation and exit. It walks through the techniques you will meet: pretexting as a helpdesk, vendor or executive; voice and text phishing; tailgating; baited USB drives; quid pro quo; on-site impersonation; dumpster diving; shoulder surfing; and the oversharing on social media and job sites that gives attackers their script.

You will then build the habits that defeat these techniques: verification by a known number, visitor control and badges, challenging politely, clean desk, information classification, what you may and may not say on the phone, and the physical protection controls that sit behind the badge reader. Realistic scenarios give you a decision to make in each.

The course is awareness-level training for every employee of a company that handles federal contract information or CUI. A company can use it as part of the security awareness training required by NIST SP 800-171 Rev 2 requirement 3.2.1 and the CMMC Awareness and Training domain, which set no fixed retraining interval, and it explains why internal reporting in minutes matters to the company's 72-hour DoD reporting duty under DFARS 252.204-7012. Follow your own company's procedures and security officer. The course closes with a 10-question examination drawn from a bank of 20. On passing you receive a PlanetISO Certificate of Completion with lifetime access. The certificate does not expire.