Developing a Social-Engineering Course

This Innovative Practice Full Paper describes an implementation of a Social Engineering course. Social Engineering (SE), which is the process of obtaining unauthorized access to systems by exploiting humans, has been flagged by the FBI and US Banking Industry as a threat to national security. According to a report by McAfee, the global cost of cybercrime has exceeded $1 trillion since 2018, and an additional $145 billion was spent on cybersecurity in 2020. Research has shown that 97% of cybersecurity attacks employ some element of social engineering. This Innovative Practice paper will present an effective and hands-on course designed to introduce students to social engineering penetration testing. The course is based on a social constructivism approach to learning, where students first develop an understanding of the individual and social context of social engineering. It uniquely combines the psychology of human behavior, legal precepts, and computer science to identify how psychological principles are applied in cyberspace to exploit individuals and how the same principles can be applied during SE penetration testing to detect vulnerabilities.