4 - Social Engineering Pen Testing

Question 1

What is Social Engineering Pen Testing?

Answer 1

Testing the strength of human factors in a security chain within the organization. Used to raise awareness among employees by allowing them to experience a real attack without having a breach. Take care not break any laws.

• Three Types of Pen Testing:
  
  • Vishing
  • Phishing
  • Physical

Question 2

What are the skills required to perform Social Engineering Pen Test?

Answer 2

• Good Communication
• Creativity
• Good Interpersonal Skills
• Talkative and Friendly Nature

Question 3

What are the common targets of Social Engineering Pen Testing?

Answer 3

• Users/Clients
• System Administrators
• Receptionists
• Help Desk Personnel/Technical Support Executives
• Vendors of the Organization

Question 4

What is the difference between Black-Box and White Box Pen Testing?

Answer 4

• Black-Box: Information is obtained by tester; not given by client
• White-Box: Tester is provided with necessary information by client

Question 5

What are the steps for Social Engineering Pen Testing?

Answer 5

• Attempt Social Engineering using email
  
  • Create fake emails to try to obtain info
• Attempt using phishing
  
  • Using fake websites, pop-ups, etc.
• Attempt using the phone (Vishing)
  
  • Act as a customer, pose as an employee, pretend to be technical support staff
  • Trick users into running commands on their computer and give out information
  • Practice convo before calling, have backup answers for every question, record conversation
• Visit company as an inquirer and Extract Privileged Information
  
  • Visit and ask questions, take pictures, ask if you can use restroom
• Visit the Company Locality
  
  • Determine number of people working in the company, create and use fake ID, attempt piggybacking/tailgating
• Attempt to use fake ID to Gain Access
• Attempt Piggybacking/Tailgating
• Listen to Employee Conversation in Communal Areas
• Identify “Disgruntled Employees” and Engage in Conversation to extract sensitive information
• Attempt Eavesdropping
• Try to shoulder surf users Logging on
• Attempt Media Dropping
• Attempt Dumpster Diving

Question 6

What are some social engineering countermeasures and recommendations?

Answer 6

• Train employees
• Implement strict badge, token or biometric authentication, employee training, and security guards
• Educate vendors
• Lock and monitor mail room, employee training
• Keep phone closets, server rooms etc. locked at all times
• Train phone executives to never reveal identity or confidential info
• Keep all trash secured, shred important data, erase magnetic media