Social engineering penetration testing : executing social engineering pen tests, assessments and defense - Watson, Gavin, 1982-; Mason, Andrew; Ackroyd, Richard (Burlington : Elsevier Science, 2014)
Social engineering attacks target the weakest link in an organization's security-human beings. Everyone knows these attacks are effective, and everyone knows they are on the rise. Now, Social Engineering Penetration Testing gives you the practical methodology and everything you need to plan and execute a social engineering penetration test and assessment. You will gain fascinating insights into how social engineering techniques-including email phishing, telephone pretexting, and physical vectors- can be used to elicit information or manipulate individuals into performing actions that.
Spear phishing -- Real-world phishing examples -- American Express-drive-by-download -- Dr. Atanasoff Gavin-advance fee fraud -- Apple ID scam-credential harvesting -- Nobody falls for this one. Nobody. Ever. -- Active e-mail reconnaissance -- Nondelivery reports -- Out-of-office responses -- The nonexistent meeting -- Impersonating the absent staff member -- Creating plausible e-mail scenarios -- Work experience placements -- Weaponizing the scenario -- The college project -- Weaponizing the scenario -- The recruitment consultant -- Salesperson -- Defending against phishing attacks -- Technological approaches -- Spam and antivirus products at the gateway, mail server, and the endpoint or client machine -- Host based intrusion preventions or "HIPS" products, and network based intrusion prevention systems -- Client application patching -- Outbound content filtering-firewalls and proxies -- Human approaches -- Setting up your own attack -- Spoofed e-mails versus fake domain names -- The SET -- Spear phishing attack vector -- Does this approach really work? -- Malicious Java applets -- Using cloned web sites to harvest credentials -- Is all of this really social engineering? -- Summary -- 10 The Telephone Attack Vector -- Introduction -- Real-world examples -- Kevin Mitnick -- Card cancelation scams -- Environmental sounds -- The issues with caller ID -- Caller ID spoofing -- Phone system hacks -- Is the contact database up to date? -- Transferring caller ID -- How to figure out if your caller ID shows up -- Summing it up -- Building on the e-mail attack -- Please contact Sarah in my absence -- Who ya gonna call? -- Job enquiries -- Sales calls -- Surveys -- Impersonating staff members -- The help desk -- Employee numbers -- Obtaining key information and access -- Credentials and e-mail access -- Physical access -- The physical access zero day.
Print version record.
Includes bibliographical references and index.
Keywords: Social engineering; SOCIAL SCIENCE -- General; Social engineering; Electronic books