 Security StrategiesNetwork World's Security Strategies Newsletter, 11/06/07Social engineering in penetration testing: PostmortemBy M. E. KabayIn the preceding column, I discussed how to plan for the use of social engineering techniques in penetration testing. Today I will take a brief look at how to use the information collected during such studies. In a Network World column published in 2000, I wrote, “In an organization wide debriefing, the results of the tests can be discussed so that everyone learns from the experience without feeling humiliated. The essential point is that by turning penetration analysis into a collective exercise, the disadvantages of social engineering can be reduced.” If one or more people succeeded in resisting social-engineering tricks, the atmosphere of the postmortem can be cheerful and low-stress: that’s the easy case. One can capitalize on the success by analyzing the successful cases; ask the people involved how they spotted the fraud, how they responded, and if there’s anything they would suggest to improve the response. Ask the social engineers what they could have done to reduce suspicions or respond better to the successful resisters. Role-playing is a powerful tool for such work - and then the group can brainstorm additional countermeasures. The whole exercise becomes an opportunity for security improvement through encouragement, praise and good will.
But how can one approach the postmortem analysis to minimize stress when someone or several people failed to counter the social engineers? Those people will be entering the discussion with a natural sense of discomfort at the least - dread and shame at the worst. It’s important to set the tone at once: “We’re here to learn from the exercise - that’s what it’s all about. I don’t want anyone to feel that they have failed the group or are a Bad Person: the exercise is _succeeding_ by bringing out areas we have to improve. Now let’s get down to business.” And by the way, that statement has to be true: Group leaders should not pretend that they are positive about the exercise if they are internally contemptuous and hostile because of the successful trickery of the social engineers. Instead, the group leaders have to either resolve their feelings before the meeting or find someone else to lead the meeting. During the postmortem, it can be helpful to use role-playing again. The people who were tricked can be encouraged to figure out what they missed, perhaps with the help of the social engineers or others. Group moderators can encourage those same victims of the trickery to act out successful resistance to the tricks, reinforcing the sense that the session is a learning experience. Keeping the tone light, friendly and positive will help counter what could otherwise become a session of bitter and dispiriting self-flagellation. Most important in all cases is to keep a record of the suggested improvements and then to plan how to implement them in a phased sequence according to the criteria the group decides on. The criteria for scheduling the improvements can include resource limitations and dependencies among the recommendations (critical-path charts can help sort out those problems). Editor's note: Starting Tuesday, Nov, 13, this newsletter will be renamed "Security Strategies Alert." Subscribers to the HTML version of this newsletter will notice some enhancements that will provide access to more resources relevant to IT security. You will still receive M. E. Kabay's analysis of this topic, which you will be able to read in its entirety online at NetworkWorld.com, along with links to relevant news headlines of the day. We hope you enjoy the enhancements and we thank you for reading Network World newsletters.
|
| Contact the author: M. E. Kabay, PhD, CISSP-ISSMP is Program Director of the Master of Science in Information Assurance and CTO of the School of Graduate Studies at Norwich University in Northfield, Vt. Mich can be reached by e-mail and his Web site. ARCHIVEArchive of the Security Strategies Newsletter. BONUS FEATURE90% of IT Managers are leaving their company at risk for a DNS ATTACK. Get the tools and resources you need to keep your DNS healthy and secure. Run a DNSreport on your domain today - 56 critical tests run in 8 seconds. Visit www.dnsreport.com to learn more. (apply coupon NWW2007NLA for a 25% membership discount) PRINT SUBSCRIPTIONS AVAILABLE International subscribers, click here. SUBSCRIPTION SERVICESTo subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here. This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription. Advertising information: Write to Associate Publisher Online Susan Cardoza Network World, Inc., 118 Turnpike Road, Southborough, MA 01772 Copyright Network World, Inc., 2007 |
1 comment:
Niсe аnswer baсk in return of this query with rеal aгguments аnd еxplaining all abοut
that.
Also visit my blog :: Same Day Payday Loans
Post a Comment