If you have
ever broken a limb you know that as you recover your doctor may send you for
therapy. As therapists rehabilitate you, you may undergo some stress testing.
This type of testing enables your doctors to see whether you have weaknesses
that need to be strengthened. The same applies for your business, except
instead of waiting for the “break” to occur before you “test,” social
engineering audits enable you to stress-test your company before a breach
occurs.
The
following sections answer a few key questions when it comes to social
engineering audits and how to choose the best auditor. Before getting into the
depth of social engineering audits, you should know what an audit really is.
Understanding What a Social Engineering Audit Is
In the most
basic terms a social engineering audit is where a security professional is
hired to test the people, policies, and physical perimeter of a company by
simulating the same attacks that a malicious social engineer would use. The two
main differences between a malicious social engineer and a professional auditor
are:
- Usually,
moral and legal guidelines exist that a professional auditor will follow.
- The goals
of the professional auditor are always to help and not to embarrass, steal, or
harm a client.
- Professional
audits generally have scope limitations that are not imposed upon real
attackers.
The
professional auditor will spend a lot of time analyzing and gathering data on a
“target” or client and will use that information to develop realistic attack
vectors. While doing this the professional auditor always keeps in mind the
goals that are set forth in writing for each audit. This is an essential piece
of the puzzle, because going down a path that can have very bad repercussions
on both the SE and the target might be tempting. Clearly defined goals can keep
a social engineering auditor from making that mistake.
Setting Audit Goals
The
professional social engineer must engage in moral and ethical behavior while
still stretching across that line that allows him or her to put on the true “black
hat” of a malicious social engineer. This means taking note of things that he
or she can use to gain access and expose a hole or weakness in a company’s
defenses, no matter how low it may seem.
Finding the
security gaps has to be balanced with a concern for the individual employees.
Companies who are hacked with a social engineering audit often think that
firing the employee(s) who fell for the attack fixes the problem and plugs the “hole.”
What the client fails to realize is that after an audit, those employees who
did fall for the attacks are probably the most secure people in the building at that time.
The
professional social engineer must take extra precaution to ensure that the
employees are not put into the line of fire. Personally I make it a key point
to tell clients that the audit is not about the employees and, as far as I can
help it, I do not include names of the employees who were used. In cases where
that cannot be helped and I need to include those names, I focus the report on
the flaws the company has in its training, policies, and defenses that allowed
the employee to falter.
When
outlining the goals of an audit with an auditor I outline the level of
intensity from 0 to 10 for these key areas:
- To
determine whether employees will click on links in emails or open files from
people they do not know well, leading to compromise
- To determine
whether an employee would go to a website and enter personal or
business-related information on that site
- To
determine how much information can be obtained via the phone or in-person
visits of employees at work or personal places (that is, bars, gyms, daycares)
- To
determine the level of security in the office perimeter by testing locks,
cameras, motion sensors, and security guards
- To
determine the ability of a social engineer to create a malicious USB or DVD
that will entice the employee to use it on his or her work computer,
compromising the business
Of course,
more areas will be tested, but what I try to do is outline closely the goals
the company has for this audit. What I find is that companies often do not know
what they want. The auditor’s job is to walk them through different avenues
into the company and to determine which of those they want tested.
What Should and Should Not Be Included in an Audit
Many
different ways exist for testing the outlined goals to see clearly whether a
security hole exists in a company. Using all the principles in this tutorial
can a security hole exists in a company. Using all the principles in this book
can help outline a good plan for attack. However, avoid some things when planning
an attack. Things like:
- Attacking a
target’s family or friends
- Planting
evidence of crimes or infidelity to discredit a target
- Depending
on the laws of the land, impersonating law enforcement can be illegal
- Breaking
into a target’s home or apartment
- Using
evidence of a real affair or embarrassing circumstance to blackmail a target
into compliance.
Things like
these should be avoided at all costs because they do not accomplish the goal
and leave the target feeling violated. However, the question does come up about
what to do if in an audit evidence appears of some of these things. Each
auditor must personally decide how to handle these circumstances, but consider
a couple of examples.
In one
audit, an auditor found out an employee was using the company’s high-speed
Internet to download gigabytes worth of porn to external hard drives. Instead
of risking the employee’s getting fired he went to the employee and told him he
knew, but he didn’t want him to get fired and just gave him a warning to stop.
The employee became embarrassed and upset and figured the auditor was going to
still report him. He decided he wanted to preemptively combat this attack and
he went to the owners and said the auditor was planting evidence of this
offense on his computer.
Of course,
the auditor had logs and screenshots of when the compromise occurred and the
employee was fired anyway. But also the auditor was reprimanded for not coming
forward when he found an offense of which the company had a strict policy.
In another
account, the auditor found evidence of a man downloading child pornography to
his computer and then distributing it to others on the Internet. The auditor
knew from the other images on his computer that he had a wife and children and
that reporting this would lead to divorce, probably jail time, and the
ruination of his career as well as the family’s life.
The law of
the land was that child pornography was illegal, as well as morally disgusting
and vile. The auditor turned the man in to the company as well as the
authorities, which cost that man his career, family, and freedom.
Having a
clearly defined “do not” list enhances your audits and keeps you from crossing
your own moral and legal guidelines. In one interview I had with Joe Navarro,
one of the world’s leaders on nonverbal communication, he made a statement
about this point. He said that unless you are a law enforcement agent you have
to decide what lines you will and will not cross before you enter into an engagement.
With that in mind then what things should an auditor include in audits?
Phishing Attacks: Targeted
email attacks that allow a company to see whether its employees are susceptible
to attacks through email.
Pretexting In-Person Attacks: Very
precise and controlled pretexts are chosen and then performed over the phone or
in-person to determine whether employees will fall for them.
Baiting: An in-person attack where access
is gained to the target’s building or other property by some method, and USBs
or DVDs are dropped that contain malicious files on them embedded with malicious
code.
Tailgating (or piggybacking): An
in-person attack where the auditor attempts to approach a group of employees to
gain access to the building by just following them in.
Physical Security (Red Team): An attempt
to gain physical access to an office and take items of value to the company.
This short
list can help a professional auditor set some guidelines to define what should
and should not be included. Still, one of the largest problems many companies
have is trying to pick out a good auditor, one who can accomplish these tasks
at hand.
Choosing the Best Auditor
If you
broke a limb and the damage was bad, and a doctor told you that you have a
chance for only 50% recovery, but that going to see a good surgeon could
increase those odds, wouldn’t you search high and low for a good surgeon to fix
your problems? And when you found him, what questions would you ask? Wouldn’t
you want to see his past work? You would want some proof of his ability to
grasp the concepts and perform the tasks that would increase your chances of
recovery.
You follow
a similar process to find the right auditor. Here are some of the basics that
you might want to find out as you speak to an auditor:
Knowledge: Has the team released any
research, papers, speeches, or other materials that display they are
knowledgeable about social engineering? Are they known in the community for
being leaders in this field? You do not want to trust your audit and security
to a team that is using outdated methods and is not up on the most recent tactics
being used.
Determining
the amount of knowledge an auditor and team has is hard to do without a little
research. Asking auditors about any papers, articles, or information they have
written on the topics is not a bad idea. Make sure the team you hire is at the
top of its game.
Experience: Clients often do not want to be
identified or named. In my case, many clients do not want to be put on a
website or marketing material because they feel this will embarrass them or make
them vulnerable. But you can determine the experience of the auditor in other
ways. Ask him about the methods he has used and how he implemented solutions in
the past.
An auditor
often does not want to let all the secrets out of the bag in an initial
meeting, but ask him for one or two accounts of attacks he launched, which will
help you determine his level of skill.
Contract: Having the audit completely
outlined, documented, and limitations set can go a long way toward a successful
audit.
Personally,
I do not like to work with a ton of limitations because most malicious social
engineers do not have any at all. But at least a small subset of rules written
out on what is and is not allowed should be agreed upon.
A social
engineer wants permission to record phone calls; video-record the building and
interactions; and especially if an audit includes physical security, to have
written permission to remove items from the premises. An auditor doesn’t want
to finish the audit just to be presented with a warrant or a lawsuit.
Also
designate an emergency contact person who knows about the audit and can vouch
for the auditor and team. If an auditor finds himself in a legal jam he’ll want
a number to call. No one wants to be performing a late-night dumpster dive to
be met by the police and have to sit the night in jail. Having a contact person
provides a “get out of jail free” card and can save a lot of hassle in the long
run.
