Social Engineering Assessment

Social Engineering is a vector that relies heavily on human involvement and often involves tricking them into breaking standard security procedures. Social engineering exploits also rely on one’s willingness to be helpful.

Usually, employees present a potential weak link in security for many organizations. While employee’s intent need not be malicious to put the organization at risk, they may not be even aware of the security risks associated with their behaviour and their role in safeguarding critical information.

These assessments help organizations understand the real-world threats to their business from the view of a malicious attacker. Usually, technical risks are often the primary focus during an audit; many times, malicious actors target employees directly, tricking them into providing sensitive information or downloading scripts.

METHODOLOGY

During Social Engineering Assessment, Krash Consulting attempts to manipulate an organization’s employees into allowing unauthorized access to confidential information. It will enable the organization to test its Information Security Policy and its employees’ adherence to that policy. By performing this exploitation test, the organization can identify failure points and train its staff to prevent an actual breach.

Our engagement techniques typically include:

• Phishing
• Email-based (Attempting to get employees to login to organization branded portals)

Krash Consulting attempts to convince the organization’s employees to reveal sensitive information through pre-defined test scenarios. This assessment can help establish the current state of security awareness among employees as well as determine gaps in policy, procedures, and enforcement.

Our methodology includes:

• Reconnaissance – Information gathering on target organization and personnel
• Create pretext scenarios, preparing for execution
• Engage targets, safely exploiting phishing pages
• Assessment Report – Detailed, risk prioritized report with remediation steps

BENEFITS

• Determine readiness in detecting and eliminating potential threats
• Assess established security controls
• Understand real-world risks