Social Engineering
Humans are one of the most fragile links in the security of an organization. Social engineering is a term that describes the non-technical intrusion into your business environment that relies on human interaction, often involving tricking people in order to break normal security policies. Social engineering techniques include everything from phone calls with urgent requests to people with administrative privileges to viruses lurking behind email messages that attempt to lure the user into opening the attachments.
Our team can help your organization identify social engineering weakness, highlight gaps in the security awareness of your employees and then train your employees to help them become more conscientious of network security.
Before the start our assignment, we closely work with the client to agree with specific and measurable test objectives. The test objectives are tailored to test-specific policies and processes within your organization. This is an excellent way for you to test the effectiveness of your security awareness training program, or to lay the foundation for creating an awareness program.
The types of social engineering testing we can provide:
- Our team shall perform Social Engineering phone calls to individuals within the organization. Targets will include individuals from the help desk, IT department, human resources, finance, and other departments within the organization. The objective of these calls will be to induce the users to divulge sensitive information over the phone in violation of company policy.
- Carefully crafted emails will be sent to individuals and groups within the organization in order to attempt to entice the user to click on an external link that will either attempt to gather sensitive information or deliver a malicious payload onto their desktop system which could include browser and operating system buffer overflows, trojan horses and keystroke loggers.
- USB Flash drives and CD-ROMs with enticing labels such as "Payroll" will be left in public areas such as hallways, restrooms, and break rooms. The media will contain simulated malicious code that will attempt to grab sensitive host information such as the network configuration, list of running processes, and a password hash dump.
- "Dumpster Diving" - Our team will search internal trash receptacles and external dumpster and disposal areas for sensitive documents and flash, magnetic or optical media that is disposed of in violation of company policy.
Regardless, of the types of social engineering testing is performed, upon completion we will provide a detailed report about the policies that were tested and the result of each attempt. Our approach is through knowledge share and understanding so that you can improve your future security posture by raising security awareness amongst your staff.