What is social engineering and how can you test against it?

Testing against Social Engineering is crucial as it exposes vulnerabilities in an organisations security systems. Simulated attacks help identify weak links and educate employees on the tactics used by malicious actors. This proactive approach ensures that appropriate measures can be taken to prevent real-world breaches and protect sensitive information.

Ataques de engenharia social utilizam emoções humanas para ter sucesso. Portanto, testar contra Engenharia social não diz respeito (diretamente) a testar processos ou sistemas e sim treinar os usuários para que identifiquem os sinais de que estão sob ataque. É sobre ensiná-los a parar por alguns segundos, respirar e avaliar melhor a situação. Qual o comportamento esperado? O que o usuário deve fazer quando se encontrar nesta situação? Ensinar o que fazer é tão ou até mais importante do que ensinar somente o que NÃO fazer.

Lorsque j’ai réalisé des tests d’ingénieurie sociale pour mes clients, les résultats étaient extraordinaires, le taux de clics sur des mails de phishing passait systématiquement de 40-60% à 8-10%. Tester régulièrement et former le personnel permet donc de contribuer grandement à l’awarness des collaborateurs, à leur vigilance mais aussi à réduire drastiquement la surface d’attaque dans l’entreprise. Je pense que c’est obligatoire aujourd’hui pour les entreprises de toute taille.

Social engineering is a form of using human emotions to manipulate people to either give out information or perform tasks. Testing against social engineering can help you build a robust security environment and also helps to create awareness on new strategies that may come up

Testing against social engineering is essential for several key reasons. It raises awareness among individuals, which results in a smarter and better-equipped workforce to defend against this dynamic threat. Testing highlights the vulnerabilities in the human layer of security, which is often considered the weakest link. This testing allows employees to experience real-world scenarios with social engineering attacks. Apart from regulatory compliance mandating social engineering testing in some industries, these attempts allow companies to identify and assess both internal and external risks to ensure a stronger security posture moving forward.

Avant de mettre en place des tests d’ingénierie sociale, il est important d’avoir le leadership de la direction et de l’informer. Ensuite, il convient de choisir quel sera le plan de formation, le moyen et la fréquence. Il y a plusieurs moyens de tester la maturité des collaborateurs. On pense souvent au phishing, mais il y a aussi des tests comme le candy dropping (lâcher des clefs USB contaminés devant l’entreprise). Ensuite il faut pouvoir mesurer et suivre les résultats produits par les différents moyens de sensibilisation mis en œuvre

Social engineering exploits human vulnerabilities to manipulate individuals or institutions for unauthorized access. Effective IT gov. requires defining scope; frameworks (COBIT, ITIL) establishing governance structure and decision-making; developing compliant policies and procedures; implementing and monitoring the framework; and continuously improving. Social engineering testing requires defining objectives, selecting testing methods, developing a test plan with target audience and scenarios, obtaining consent, conducting tests, analyzing results to identify vulnerabilities and improvements, reporting findings to recommend remedial actions. Following structured steps for governance and testing ensures managing IT risks and opportunities

Ao realizar uma simulação de engenharia social é importante estabelecer uma relação de confiança e deixar bem claro que a simulação é para treiná-los e não engana-los. Analisar os resultados e divulgá-los para o público alvo também é muito importante.

A good start would be to categorize the results according to the attack vector used, ie Phishing. Under these categories, one can analyze exactly where and why the human layer of security failed or succeded as well as document success/fail rates. Next, put your findings in priority from the lowest to the highest threat level. Every threat should be provided with a method of mitigation which could be anything from training, to actual hardware and software tools being implemented. Lastly, condense the report while highlighting attack vectors used, successes, failures, and ways to mitigate them. The organization can then use the report along with expert recommendations to implement any needed solutions.

The human factor is the most important thing here. Most social engineering attacks are human-centred. Educate and train your human resources to identify a social engineering tactic not to fall prey to these attacks.