Social Engineering Assessment Cheat Sheet
Andrew Mason, Technical Director, RandomStorm Limited
This chapter will bring together the entire book into a simple to use cheat sheet and flowchart that helps a security engineer plan and perform a social engineering assessment. The flowchart will refer chapters of the book where the reader can gain further insight into the tools and techniques required and the aim is to provide an easy to use system based upon the methodology presented throughout the book.
Keywords
Social Engineering; Framework; Cheat-sheet; Process; Methodology
Information in this chapter
Introduction
Chapter 16 looked at how social engineering assessments can be used internally within a company as a method to raise security awareness and build stronger policies to hopefully prevent exposure from a real social engineering threat.
The aim of this chapter is to bring together all the elements of the book into a simple to use cheat sheet and flowchart that helps a security engineer plan and perform a social engineering assessment. The flowchart will refer chapters of the book where the reader can gain further insight into the tools and techniques required, and the aim is to provide an easy to use system based upon the methodology presented throughout the book.
Social engineering framework
Chapter 5 presented a framework for social engineering that was loosely based on the Penetration Testing Execution Standard or PTES—http://www.pentest-standard.org/index.php/Main_Page. The idea of this framework is to provide structure to the planning and performing of a social engineering assessment to enable a repeatable standard to be adhered to by an organization performing such consultancy.
A flowchart-based outline of the proposed framework can be seen in Figure 17.1 and also explained below as follows.
• Pre-engagement interaction
This initial section covers everything that happens before the engagement and looks at topics such as scoping, goals, establishing lines of communication, rules of engagement, and legal protections required as part of the engagement. Some of these concepts are covered in Chapter 13.
• Intelligence gathering
This section is the first section once the engagement is underway and covers the initial groundwork in uncovering information that can be leveraged as part of the social engineering assessment. Examples of information to be gathered can include gathering corporate email addresses from search engines and social networks, parsing document metadata from publicly available corporate documentation, and establishing contact details such as phone numbers for switchboards and receptions. This section is covered in detail in Chapter 8.
• Threat modeling
This section creates the model for the social engineering assessment to follow. This model looks at the results of the initial information gathering and in combination with the requirements of the customer allows you to create a targeted attack scenario based upon a chosen attack vector. Although threat models use similar attack vectors the way they are designed and implemented are unique to each customer. Threat modeling is covered in Chapter 6 and also Chapter 7.
• Execution
This section covers the actual execution of the social engineering assessment that is considered as the primary objective of the engagement. This is where all of the information gathered is used against the threats that have been modeled in order to perform a threat-based assessment. The objective for the consultant is to gain access to the systems, or to break the procedures, that were identified in the earlier stages of the assessment. Information about executing such assessments through the three main attack vectors can be found in Chapters 9–11. Further information about how these attack vectors can be supported through technology can be found in Chapter 12.
• Post-execution
This section covers the secondary objective of the engagement which is possible only after the assessment has been successfully performed. For example, the primary objective may have been to gain physical access to the building, by tailgating, which was performed during the execution. The post-execution task and secondary objective may be to gather up sensitive information and exfiltrate without being caught or noticed. The social engineering aspects of post-execution are covered as above in Chapters 9–12. Many post-execution tasks are network based and are outside the scope of this book as they are considered more in line with infrastructure penetration testing.
• Reporting
Once the assessment is complete, the report is then created from the findings and results from executing the assessment. This is deliverable to the client and a very important piece of work that must meet the business objectives that drove the social engineering assessment in the first place. The report takes form of a written piece of work that includes all evidence gathered and methods used. It is normal that the report is collated and written by the consultant who performed the actual assessment. It is also advised to make the consultant available to present the findings verbally or at least be available for a conference call to answer any question that the client may have regarding the assessment that was performed. More information about gathering the information for and writing the actual report can be found in Chapter 13.
Social engineering cheat sheet
Expanding on the framework flowchart as seen in Figure 17.2, additional components may be added to the chart to create a more in-depth cheat sheet that summarizes and links to the key concepts provided in this book. This book has provided extensive chapter and page references in the flowchart so that enables cross referencing of the flowchart with sections of the book appertaining to the topic.
Summary
This final chapter has provided a brief summary and an associated flowchart of the social engineering framework that was presented in Chapter 5. Next, the flowchart was expanded to include more details under each section in an attempt to turn it more into a graphical representation of the major concepts covered within this book. It is hoped that this cheat sheet can act as a summary guide to relate the steps in the model to sections in the book for quick reference at a later date.