book

Social Engineering in IT Security: Tools, Tactics, and Techniques

Name: Social Engineering in IT Security: Tools, Tactics, and Techniques
Author: Sharon Conheady
ISBN: 9780071818476

by Sharon Conheady

August 2014

Intermediate to advanced

272 pages

8h 49m

English

McGraw-Hill

Read now

Unlock full access

Cover
Title Page
Copyright Page
About the Author
Contents at a Glance
Contents
Foreword
Acknowledgments
Introduction
Chapter 1: Introduction to Social Engineering
Different Types of Social EngineeringPhysical Social EngineeringRemote Social EngineeringCombination AttacksThe History and Evolution of Social EngineeringThe Golden Age of Con ArtistrySocial Engineering in the 1920s: Charles PonziSocial Engineering in the 1940s: The War MagicianSocial Engineering in the 1950s: Frank AbagnaleSocial Engineering in the 1970s–1990s: Kevin MitnickSocial Engineering Since 2000Who Are the Social Engineers Today?Opportunists with Little PreparationOrganized External AttackersInternal AttackersIntroduction to Social Engineering TestingThe Social Engineering Test MethodologyFinal Thoughts

Chapter 2: The Legal and Ethical Aspects of Social Engineering Tests
Malicious Social Engineers vs. Ethical Social EngineersRadio DJs and Kate Middleton Prank CallThe Epic Hacking of Mat HonanCondé Nast Transfers $8 Million to Spear PhisherIs It Legal? Is It Ethical? The Legal and Ethical Aspects of Social EngineeringThe Social Engineering ContractThe Get Out of Jail Free CardLaws You May BreakLegal and Ethical OptionsLegal Do’s and Don’tsFree Pizza and Social Engineering in Your Personal LifeFinal Thoughts
Chapter 3: Why Social Engineering Works
Misplaced Trust in the Social EngineerDetecting DeceptionWhy Do We Trust?Appearing TrustworthyRespect for AuthorityFactors that Increase Our Tendency to ObeyIndicators of AuthorityHelpfulnessMotivators to Aid the Social EngineerPositive Motivations: ReciprocityNegative Motivations: Pressuring the VictimLack of Personal ResponsibilityBystander EffectLack of AwarenessPeople Don’t Realize Social Engineering Is a ThreatPeople Don’t Think They Will Be Targeted by Social EngineersPeople Think They Would Never Fall for a Social Engineering ScamPeople Don’t Know What to Do When They Face a Social Engineering AttackFinal Thoughts
Chapter 4: Planning Your Social Engineering Test
Assessing the ThreatTypes of AttackersCurrent Awareness LevelsScoping the Social Engineering TestType of TestTime to Allocate to TestGoals and DeliverablesPlanning the ProjectTest PlanTeam PlanCommunications PlanRisk Management PlanDefining the Rules of EngagementRestrictions on TestingCalling Off the TestPermission to TestWho Should Be Informed About the TestCase Study: Social Engineering a Banking Call CenterFinal Thoughts
Chapter 5: Research and Reconnaissance
What Types of Information to Look for in the Reconnaissance PhaseWhere to Look for InformationCompany WebsitesRecruitment WebsitesNewspapers and the PressWHOISConferences and Public EventsOfficial FilingsCommercial SourcesGray LiteratureInformation Gathering on Social NetworksSpecific Social Networking SitesPhysical ReconnaissanceDumpster DivingTelephone ReconnaissanceReconnaissance for Call CentersChallenges During the Research and Reconnaissance PhaseFinal Thoughts
Chapter 6: Creating the Scenario
Brainstorming Potential ScenariosValidating ScenariosAdding CredibilityCharacter DevelopmentCostumesPropsIdentifying Possible PitfallsAssigning RolesPracticing Again and AgainFinal Thoughts
Chapter 7: Executing the Social Engineering Test
Executing a Phishing TestA Non–Social Engineering Phishing TestExecuting a Telephone Social Engineering TestExecuting an Onsite Social Engineering TestThe Basic RoutineCommon Actions once InsideRecording the TestTrophy GatheringCreating a Good Road Apple/Physical BaitWalking Through Doors: Access Codes and TailgatingCoffee/Smoking Break AnalysisBuilding RapportHow to Make Small TalkWhat to Do If You Are ChallengedWhat Else Can Go WrongFinal Thoughts
Chapter 8: Writing the Social Engineering Report
Continuous Feedback and ReportingRecording Events During the TestHow Much Time Should You Allow for Report Writing?Planning the ReportEstablish Who Your Target Readers AreSpecific Client RequestsRisk Ratings for Social Engineering FindingsStandard Report ContentsExecutive SummaryTechnical DetailsExample ReportAppendixesThe Quality Assurance ProcessDistributing the ReportFinal Thoughts
Chapter 9: Tools of the Trade
Research and Reconnaissance ToolsMaltegoCree.pySpokeoThe Wayback MachineMetadata Collectors: FOCA and MetagoofilScenario Creation ToolsTest Execution ToolsWhat to Bring on Your Social Engineering TestRecording DevicesBugging DevicesKeystroke LoggersDisguised Storage DevicesThe Cell PhonePhone Tools and Caller ID SpoofingThe Social-Engineer ToolkitFinal Thoughts
Chapter 10: Defense Against the Dark Arts
Indicators That You May Be Experiencing a Social Engineering AttackThe Person’s AttitudeEstablishing a ConnectionThe Nature of the RequestPressure/UrgencySmall MistakesDifficulty of Independent ValidationHave You Been Social Engineered?Social Engineering Checklist: Have You Been Social Engineered?Responding to Social Engineering AttacksSecurity Policies and ProceduresData Classification PolicyPhysical Security Policy: VisitorsSocial Engineering Education and AwarenessPhysical and Technical ControlsSocial Engineering Tests as DefenseFinal Thoughts
Chapter 11: Social Engineering: Past, Present, and Future
Same Tricks, New TechnologyThe Spanish Prisoner, 16th CenturyThe Letter from Jerusalem, 19th CenturyAdvance Fee Fraud Revival, Early 20th CenturyAdvance Fee Fraud Scams Since the 1970sNew Technology, New Targets, New DeliverySeeing Around CornersRemote Controllable CockroachesBiometricsThe Internet of ThingsEasier Profiling, More Believable AttacksSocial NetworksThe CloudWearable TechCountering SurveillanceImplanted TechFinal Thoughts
Index

Content preview from Social Engineering in IT Security: Tools, Tactics, and Techniques

8	Writing the Social Engineering Report

(News) reporting is a cycle: No matter how much you work at sending a message, it’s only successful if it’s received.

—Jessica Savitch, news reporter

Putting together a social engineering report is by far and away the most tedious part of the whole social engineering process, but it has to be done. The report is the only tangible output from the social engineering process and, as such, is effectively what your client is paying for. It’s especially hard to put together because it comes after you have had so much fun actually executing the test. Unfortunately, as a result, this chapter is probably the most boring one in this book, although I will try to make it as interesting as possible. On some very ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Cybersecurity - Attack and Defense Strategies

Publisher Resources

ISBN: 9780071818469

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Social Engineering in IT Security: Tools, Tactics, and Techniques

by Sharon Conheady

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.