We end where security really lives — not in the maths or the machines, but in people. You can deploy flawless cryptography, perfect TLS, a hardened network and a vigilant SOC, and an attacker can still walk straight past all of it by sending one convincing email. The uncomfortable truth of the field is that the human is the most attacked, and most vulnerable, part of any system.
Social engineering: hacking people, not computers
Social engineering is manipulating people into doing something that undermines security — revealing a password, clicking a link, approving a payment, letting someone through a door. Its most common form is phishing: a message impersonating someone trusted (a colleague, a bank, IT support) to trick the target into acting. It works because it exploits human instincts — urgency ("your account will be closed!"), authority ("this is the CEO"), and helpfulness — that no firewall can patch.
Recall the attack lifecycle: initial access is most often a phished credential, not a zero-day exploit. Attackers target people because it's easier than breaking technology. Any security model that assumes users will always behave perfectly is already defeated.
Defending the human layer
You cannot "patch" human nature, so mature defence assumes people will be fooled and limits the damage when they are:
- Phishing-resistant MFA — hardware keys and passkeys (the auth lesson) that can't be relayed to a fake site, so a stolen password alone is useless.
- Least privilege — give every person and system the minimum access they need, so a compromised account is a small fire, not a catastrophe.
- Blast-radius thinking — segment, monitor and rate-limit, so one fooled user can't reach everything (this is zero trust and defence in depth, applied to people).
- Training and a healthy culture — teach people to recognise manipulation, and — crucially — make it safe to report a mistake. A culture where "I think I clicked something bad" is met with thanks, not punishment, catches incidents early; a culture of blame hides them until they're disasters.
Usable security wins
The deepest expert lesson: security that people can't actually use is not secure. Passwords so complex they get written on sticky notes, procedures so onerous they get bypassed, alerts so frequent they get ignored — each is a control that looks strong and is worthless. The best security is usable: it makes the secure path the easy path, so people follow it naturally. Security is ultimately a property of an organisation and its culture, not a product you install.
That completes the Cyber Security track, first principles to the front line: the CIA triad and threat modelling, the cryptographic primitives, TLS and authentication, the web flaws attackers use, the attack lifecycle and network defences, detection and response, and — the layer that ties it all together — the human one. Real security is all of these, maintained together, by people who assume things will fail and plan accordingly.