Social Engineering Testing

Social engineering attacks continue to be one of the most common and successful attack strategies for criminals seeking to attack an organization. These attackers manipulate employees to reveal passwords or download malware-infected files that result in stolen credentials networks, data breaches and fraudulent wire transfers.

The best way to determine your organization’s susceptibility to social engineering is to test employees in a way that imitates real attacks without inflicting real damage. Social engineering testing gives you an idea of how malicious actors may target personnel in a real-life attack. Attackers often count on a lack of security awareness to grant them a foothold into an environment—a simulated attack can reveal the current state of employees’ awareness and response to social engineering.

The goal of this type of testing is to determine the following: If your employees receive suspicious emails, how would they respond? Would they report it to the security team? Would they click on links from unknown users? Are they aware of phishing response procedures? Would they submit credentials to someone over the phone or to an unknown website? Would they allow strangers into sensitive areas of the facility?

Partners First initiates any of these scenarios to test how your organization responds. These scenarios can include:
•Targeted spear phishing attacks
•Phone-based social engineering
•USB drops

The pretexts for scenarios are crafted based on extensive research of open source intelligence - information that any external malicious actor could obtain. In this way, it closely mirrors the way an attacker would target your environment. This allows you to track user responses, and then adapt security awareness training and security procedures to coincide with current attack strategies.

Testing should provide a company with information about how easily an intruder could convince employees to break security rules or divulge or provide access to sensitive information. The company should also get a better understanding of how successful their security training is and how the organization stacks up, security-wise, in comparison to their peers.

Social engineering testing may be conducted as part of more comprehensive penetration tests (pen tests). Like ethical hacking methods, the tests themselves generally replicate the types of efforts that real-world intruders use.

Physical testing, for example, might involve a tester trying to enter a secured building at a time when many employees are entering, perhaps talking on a phone and carrying multiple items to see if someone just holds the door open rather than adhering to the approved procedure of letting the door close after them so any person following must use an employee card or badge for entry.

Phishing exploits, a common social engineering method, are often used to test employee vulnerability. Testers might send an email purportedly from someone in management asking the employee to open an unexpected attachment, provide sensitive information or visit an unapproved website.

A tester might call employees pretending to be someone in IT, providing them with new passwords and telling them to change their current passwords to the new ones.