Cyber Strategy
Cyber Secure
Cyber Operations
Cyber Response
Cyber Resilience
Menu
Cyber Secure
Services
Cyber Secure
Services
Social Engineering – Targeting the Human Weakness
DTS has conducted more than 50 social engineering simulations over the last couple of years and the results are incredible.
The level of cyber security awareness amongst employees across different industries, varies from one spectrum to another, on average, more than 60% of users fall for the bait by clicking on a link on a highly crafted email from our covert operations team.
This not only demonstrates there is a lack of employee engagement in training and raising awareness of cyber security threats that are most commonly used, but also employees not having the ability to identify the good and the bad. The core benefits of running a social engineering simulation are to;
- Simulate a social engineering attack on elements of your organization
- Gauge the effectiveness of information security awareness training
- Improve the resilience of your organization to social engineering and phishing attacks
The majority of recent high profile cyber-attacks against top tier organizations have been successful because they have breached the perimeter through targeted social engineering attacks, otherwise known as ‘spear phishing’.
These attacks identify the contact details of potentially vulnerable people within the organization and use a specially targeted attack vector which is likely to result in the execution of malicious code. Typically, this involves crafting an email which would be of interest to the victim incorporating embedded malware, in the email itself or as an attachment.
Once the code has been executed, it will then use network architecture weaknesses to establish command and control connections with the attacker who can then commence attacks on internal network resources. It is then generally straightforward to identify accessible stores of internal information assets (given access will have been gained with the credentials of the compromised user) and export them over the internet using usually benign and innocuous protocols such as web connections over encrypted channels to bypass security controls.
Furthermore, other attack vectors often include using phone calls to staff, usually under the guise of IT personnel or a senior member of staff and attempting to entice them into performing a task that would also have adverse consequences for the organization’s information security.
A defense-in-depth strategy for the protection of information assets should include all elements of security controls, including physical, procedural and technical. As such, it is essential that personnel within the organization are adequately briefed on information security awareness, how to identify and report potentially malicious emails and the inherent risks associated with opening them.
Social Engineering simulation by DTS, will effectively identify an organization’s susceptibility to social engineering attacks, whether delivered via email, instant messaging, telephone calls or face-to-face within the client’s premises. As part of the assessment, we can use open source intelligence gathering to attempt to identify people within the organization or target a specific team or function that the client determines should be the subject of the investigation.
We will then systematically target those individuals with a bespoke attack which we believe (in co-ordination with the client) has the highest probability of success. All attempts will incorporate a means to measure the success and may also determine whether it would be possible to breach the architecture and establish outbound command and control connections.
The output of the exercise shall position the effectiveness of information security awareness within the organization, statistics on successful and unsuccessful attempts, details on whether it was possible to compromise the perimeter and to provide a detailed set of issues alongside pragmatic remedial activities that can be used to make improvements.
SOCIAL ENGINEERING – SCENARIOS
Our covert testing team in DTS, has undergone training from third party agencies to develop social skills and structure these types of assessments. This combined with their personal attributes enabling them to convincingly assume the roles they adopt and their experience in Information Security make them an ideal team for this type of exercise, some of the tests conducted during this assessment is as follows:
- Telephone Impersonation
- Email Phishing
- Onsite Impersonation
- Clean Desktop Testing
- Suspicious Activity Testing
- Dumpster Diving and Shred Testing
- Tailgating
- Piggybacking
- Reverse Social Engineering
- Shoulder Surfing
- Remote Access VPN Account Compromise
This not only demonstrates there is a lack of employee engagement in training and raising awareness of cyber security threats that are most commonly used, but also employees not having the ability to identify the good and the bad. The core benefits of running a social engineering simulation are to;
- Simulate a social engineering attack on elements of your organization
- Gauge the effectiveness of information security awareness training
- Improve the resilience of your organization to social engineering and phishing attacks
The majority of recent high profile cyber-attacks against top tier organizations have been successful because they have breached the perimeter through targeted social engineering attacks, otherwise known as ‘spear phishing’.
These attacks identify the contact details of potentially vulnerable people within the organization and use a specially targeted attack vector which is likely to result in the execution of malicious code. Typically, this involves crafting an email which would be of interest to the victim incorporating embedded malware, in the email itself or as an attachment.
Once the code has been executed, it will then use network architecture weaknesses to establish command and control connections with the attacker who can then commence attacks on internal network resources. It is then generally straightforward to identify accessible stores of internal information assets (given access will have been gained with the credentials of the compromised user) and export them over the internet using usually benign and innocuous protocols such as web connections over encrypted channels to bypass security controls.
Furthermore, other attack vectors often include using phone calls to staff, usually under the guise of IT personnel or a senior member of staff and attempting to entice them into performing a task that would also have adverse consequences for the organization’s information security.
A defense-in-depth strategy for the protection of information assets should include all elements of security controls, including physical, procedural and technical. As such, it is essential that personnel within the organization are adequately briefed on information security awareness, how to identify and report potentially malicious emails and the inherent risks associated with opening them.
Social Engineering simulation by DTS, will effectively identify an organization’s susceptibility to social engineering attacks, whether delivered via email, instant messaging, telephone calls or face-to-face within the client’s premises. As part of the assessment, we can use open source intelligence gathering to attempt to identify people within the organization or target a specific team or function that the client determines should be the subject of the investigation.
We will then systematically target those individuals with a bespoke attack which we believe (in co-ordination with the client) has the highest probability of success. All attempts will incorporate a means to measure the success and may also determine whether it would be possible to breach the architecture and establish outbound command and control connections.
The output of the exercise shall position the effectiveness of information security awareness within the organization, statistics on successful and unsuccessful attempts, details on whether it was possible to compromise the perimeter and to provide a detailed set of issues alongside pragmatic remedial activities that can be used to make improvements.
SOCIAL ENGINEERING – SCENARIOS
Our covert testing team in DTS, has undergone training from third party agencies to develop social skills and structure these types of assessments. This combined with their personal attributes enabling them to convincingly assume the roles they adopt and their experience in Information Security make them an ideal team for this type of exercise, some of the tests conducted during this assessment is as follows:
- Telephone Impersonation
- Email Phishing
- Onsite Impersonation
- Clean Desktop Testing
- Suspicious Activity Testing
- Dumpster Diving and Shred Testing
- Tailgating
- Piggybacking
- Reverse Social Engineering
- Shoulder Surfing
- Remote Access VPN Account Compromise
Solutions
Network and Infrastructure Security
Zero Trust and Private Access
Endpoint and Server Protection
Vulnerability and Patch Management
Data Protection
Application Security
Secure Software and DevSecOps
Cloud Security
Identity Access Governance
Governance, Risk and Compliance
Security Intelligence Operations
Incident Response
Dubai
Abu Dhabi Office 7, Floor 14
Makeen Tower, Al Mawkib St.
Al Zahiya Area
Abu Dhabi, UAE
Kuwait Mezzanine Floor, Tower 3
Mohammad Thunayyan Al-Ghanem Street, Jibla
Kuwait City, Kuwait
+971 4 3383365
[email protected]
London 160 Kemp House, City Road
London, EC1V 2NX
United Kingdom
Company Number: 10276574
The website is our proprietary property and all source code, databases, functionality, software, website designs, audio, video, text, photographs, icons and graphics on the website (collectively, the “Content”) are owned or controlled by us or licensed to us, and are protected by copyright laws and various other intellectual property rights. The content and graphics may not be copied, in part or full, without the express permission of DTS Solution LLC (owner) who reserves all rights.
DTS Solution, DTS-Solution.com, the DTS Solution logo, HAWKEYE, FYNSEC, COMPLYAN, FRONTAL, HAWKEYE CSOC WIKI and Firewall Policy Builder are registered trademarks of DTS Solution, LLC.