MuggsTech · Course 2: IT Support Technician · Security unit
Lab: Spot the Con
NameDatePeriod
In the comic, nobody broke into a computer. Every attempt went after a person instead. Today you'll practice catching those attempts the way Dee did: reading messages closely, checking who is really asking, and writing it up so the next person is warned.
Part A. Read the comic
- Answer each question in a complete sentence. The panel numbers tell you where to look.
| Question | Your answer |
|---|---|
| 1. Panel 2: What two things does the caller do to get Ms. Harris to act fast? | |
| 2. Panel 4: Why is calling the poster's number verification, while calling Kevin back is not? | |
| 3. Panel 5: Which step of the attack did Ms. Harris stop, and how? | |
| 4. Figure 1 (panel 7): Which warning sign would you check first, and why? | |
| 5. Panel 9: Why is walking in after you badge in with your own card not tailgating? |
Part B. The inbox
- Read each message. Decide whether it is phishing (or smishing) or a real message.
- Write the warning sign you found, or the reason you trust it. Some of these are real.
| Message | Phish or real? | Warning sign or reason |
|---|---|---|
| From "Principal Jones" <principal.jones.school@freemail.example>: "Are you at your desk? I need a quick favor. Buy four gift cards and text me the numbers." | ||
| From IT <helpdesk@schools.example.org>: "Hi Ms. Harris, the Wi-Fi in Building B will be off Saturday from 8 to 10 a.m. for repairs. You do not need to do anything." | ||
| Text from 504-555-0199: "Your package could not be delivered. Pay the $1.99 fee here: parcel-fee.example/track" | ||
| From Payroll <payroll@schools-pay.example.net>: "Your direct deposit failed. Sign in within 2 hours to update your bank details or miss this paycheck." | ||
| From your teacher, through Google Classroom: "Lab sheets are due Friday. See the rubric attached to the assignment." | ||
| A pop-up with a loud alarm, signed "Microsoft Support": "Your computer is infected. Call 1-800-555-0137 now. Do not turn off your computer." |
Part C. The call
- Work in pairs. One person reads the caller card and plays the caller. The other uses the receiver checklist. Then switch.
- Caller card: You are "Sam from the district office." Say there is a problem with the receiver's account and you need their password to fix it before lunch. If they push back, say your boss is upset and this has to happen now.
- Receiver checklist: (1) Ask the caller's name and department. (2) Never give a password or a code. (3) Say you will call back through the help desk. (4) Hang up and find the real number yourself. (5) Report the call.
| Round 1 | Round 2 | |
|---|---|---|
| Which checklist steps did the receiver do? | ||
| What pressure did the caller use? |
Part D. The report
- Write the incident report Dee would send for the morning in the comic. Write it for a security team member who was not there.
| Field | Your report |
|---|---|
| Date, time and location | |
| What happened (all three attempts) | |
| What was shared, if anything | |
| What was done | |
| What the team should do next |
Think about it
The teacher in panel 8 was being polite. How could a school keep people polite and still stop tailgating? Answer in two or three sentences.
Words to know
- Social engineering
- Tricking a person into giving up information or access, instead of breaking into a computer.
- Impersonation
- Pretending to be someone the person trusts.
- Urgency
- Pressure to act right away, so the person acts before thinking.
- Vishing
- Social engineering over the phone.
- Phishing / smishing
- Social engineering by email / by text message.
- Tailgating
- Following an authorized person through a secured door without using a badge.
- Shoulder surfing
- Watching someone type a password or PIN.
- Verification
- Contacting the person through a number or address you already know is real.