One of the most successful methods spies and criminals use to gain access to a company is social engineering. Social Engineering Testing is a part of penetration testing that aims to identify and validate weaknesses associated with your staff’s ability to abide by detailed policies and methods. An attack is usually carried out by someone who intentionally influences a staff member’s judgement or general interest.
How we can help
Advances in computer and information security have made it increasingly difficult to hack into an organisation. Network defences, encryption and detection systems have forced cyber attackers to find easy targets. These targets are usually staff who may unknowingly divulge sensitive information. This could be at a social gathering, or by placing a USB drive that they found with their company branding on it into their computer thus infecting it with a Trojan
Common methods social engineers use are:
- BAITING – whereby the attacker leaves an infected peripheral such as a USB memory stick in a common staff area in the hope a staff member inserts it into their computer or hands it to the IT department.
- TAILGATING – whereby an attacker follows another staff member into a secure area before the door has closed
- PHISHING – whereby an assailant sends an email masked as another staff member or a genuine source and directs the staff member to open the infected file or follow a link
- PRETEXTING – whereby the attacker persuades a staff member to hand over restricted material by mimicking someone else.
By testing and measuring your staff’s response to external emails and calls or analysing and measuring the physical security in a sensitive area of your company or by conducting a controlled baiting exercise to see the extent of the staff’s security awareness, our experts are able to secure your intellectual property and trade secrets to give you peace of mind.
Red Team Testing
What is a Red Team? A Red Team is a group of experts who act like motivated attackers. Their objective is to test the security of an organisation. All aspects of security are tested, from physical, cyber, information, operational, and social engineering. The Red Team needs to essentially gain access to a part of a facility undetected and report on all vulnerabilities and risks by any means possible, then report on the findings. We would then implement security measures based on our recommendations.
Other types of penetration tests focus on one type of security control, whereas a Red Team focuses on gaining access.
A Red Team will encompass a variety of exercises, all with the authority of the client:
- Surveillance and reconnaissance
- Social engineering
- Site inspection and assessment
- Physical penetration
- Access pass duplication
- Picking locks and more