SOCIAL ENGINEERING

Scope Outline

Social engineer training will include grouping your employees into categories that provide in-depth analysis, say department-wise. Phishing test tools will help recognise the nature of the threat to their organisation as a whole as well as to individual employees.

Phishing Test

A phishing website and a phishing email account will be created. Through the employee analysis, a target-oriented phishing email will be sent out that links to the test website. There will be all forms of material to obtain information, like questionnaires, usernames, passwords, etc. Through this exercise, we can deduce how many employees click to see the website and will be potential victims.

Social Engineering Testing Tools

Social engineering testing software PhishMe (using.csv files) will analyse employee behaviour at every level of the process so you can know all the employee concerns and escalation during the testing. PhishMe pricing may justify the incredible data analysis with easy-to-use modules.

Employee Education

Providing statistics to the employees gives insights into the impact of an attack. The exercises can be continued with different gamification techniques, e-learning modules, seminars, or workshops to track and measure the success of the programme.

Repeat the Process 

The repetition of the entire cycle periodically prepares the organisation to spot a malicious email almost immediately. This will turn your employees into the strongest defence against phishing. Although there are several free phishing simulation tools and phishing test sites available, employing credible creators will ensure confidentiality and provide practical solutions for the long run.

• 1 – Information Gathering

  Reconnaissance is the start of any social engineering assessment. While often neglected in many commercial services, information gathering is a critical phase and often determines the success of the rest of the social engineering campaign.
  

• 2 – Reporting and Debrief

  After completing the social engineering assessment and aggregating the results, the social engineering report is written, outlining both an executive summary and specific engagement details. Remediation steps and training guidance are also provided, directing the client to resolve the training and policy issues identified.
  Once the client’s team has reviewed the closeout report, a debrief meeting is scheduled to walk through the details and answer any questions.
  

• 3 – Engage Targets

  Using the specified tactics and pretext, Rhino Security Labs’ assessors begin engaging specified employees with the appropriate emails or phone calls. For on-site assessments, a series of tests are started, including tailgating users and ‘baiting’ with USB drives left in parking lots or other common areas. For advanced engagements, which can incorporate social media or SMS to build rapport, the first of multiple interaction stages begins.
  

4 – Create Pretext Scenarios and Payloads

Once the full enumeration of the client organisation and its employees has been completed, focus turns to the pretext scenarios and payloads for the social engineers.
These details should answer the following questions:

• Pretext scenarios: Which will raise interest or reduce concern?

• Source information: Which domains or phone numbers are needed?

• Validity: What else can be done to improve pretext legitimacy?

• Payloads: What’s the target information or access to obtain?

• 5 – (Optional) Employee Education

  As an optional addition to the standard assessment, Rhino Security Labs provides user training sessions for client employees. Whether hosted in a recorded online webinar or an in-house training session, provide quality security awareness training by the same experts who performed the original engagement!