1. Social Engineering By: Pete Guhl and Kurt Murrell

2. Techniques

3. Phases of Social Engineering - Very similar to how Intelligence Agencies infiltrate their targets - 3 Phased Approach Phase 1- Intelligence Gathering Phase 2- “Victim” Selection Phase 3 -The Attack - Usually a very methodical approach

4. Phase 1 -Intelligence Gathering - Phase 1 -Intelligence Gathering - Primarily Open Source Information Dumpster Diving Web Pages Ex-employees Contractors Vendors Strategic Partners - The foundation for the next phases

5. Phase 2 -”Victim” Selection Looking for weaknesses in the organization’s personnel Help Desk Tech Support Reception Admin. Support Etc.

6. - Phase 3 - The Attack - Commonly known as the “con” - Primarily based on “peripheral” routes to persuasion Authority Liking & Similarity Reciprocation - Uses emotionality as a form of distraction

7. 3 General Types of Attack Ego Attacks Sympathy Attacks Intimidation Attacks

8. Intimidation Attack Attacker pretends to be someone influential (e.g., authority figure, law enforcement) Attempt to use their authority to coerce the victim into cooperation If there is resistance they use intimidation, and threats (e.g., job sanctions, criminal charges etc.) If they pretend to be Law Enforcement they will claim the investigation is hush hush and not to be discussed etc.

9. Sympathy Attacks Attacker pretends to be a fellow employee (new hire), contractor, or a vendor, etc. There is some urgency to complete some task or obtain some information Needs assistance or they will be in trouble or lose their job etc. Plays on the empathy & sympathy of the victim Attackers “shop around” until they find someone who will help Very successful attack

10. The Ego Attack Attacker appeals to the vanity, or ego of the victim Usually targets someone they sense is frustrated with their current job position The victim wants to prove how smart or knowledgeable they are and provides sensitive information or even access to the systems or data Attacker may pretend to be law enforcement, the victim feels honored to be helping Victim usually never realizes

11. More info on attacks Attacks can come from anywhere/anytime Social Engineering can circumvent current security practices - What good is a password if everyone has it? No one is immune - Everyone has information about the company

12. Preventing Social Engineering

13. Training Warn Users of Imminent Attack - Users that are forewarned are less free with information

14. Training Define Sensitive Information

15. Training Define Sensitive Information Passwords

16. Training Define Sensitive Information Passwords DOB

17. Training Define Sensitive Information Passwords DOB Maiden Names

18. Training Define Sensitive Information Passwords DOB Maiden Names Social Security Number

19. Training Define Sensitive Information Passwords DOB Maiden Names Social Security Number Account Numbers

20. Training Define Sensitive Information Passwords DOB Maiden Names Social Security Number Account Numbers Billing Amounts

21. Training Users Passwords, phone numbers, other data

22. Training Users Passwords, phone numbers, other data System Admins Tougher authentication protocol for password resets

23. Testing Users - Reveal seemingly innocuous data?

24. Testing Users - Reveal seemingly innocuous data? System Admins – Divulge network information?

25. Testing Users - Reveal seemingly innocuous data? System Admins – Divulge network information? Helpdesk personnel – Reset passwords on faulty authentication?

26. Removing the Weak Link Remove the user’s ability to divulge information - Remove all non essential phones - Restrict to internal communications - Remove Internet access - Disable removable drives - Make false information accessible

27. Removing the Weak Link Forced strong authentication - Use secure software requiring strong authentication for password resets - Require callback to user’s directory listed number

28. Removing the Weak Link Secure Protected Doors - Employ Guards - Use Revolving Door - Two Door Checkpoint - Deploy CCTV to remote facility