Social Engineering Testing

In information security, the human element is often the weakest link; leaving an organisation open to unintentional vulnerability. Social engineering is an attack vector which relies on the psychological manipulation of people to gain access to systems. Any business wishing to gain a current and valuable knowledge base around the day-to-day threats facing all staff members can enlist a trusted third party to simulate this type of event and provide follow-up training to make sure any knowledge gaps are filled.

These types of attack exploit individuals within an organisation. They range in sophistication but commonly include scams where attackers attempt to persuade employees to divulge confidential passwords or sensitive information. Known by terms such as phishing, pretexting, baiting, tailgating or Quid Pro Quo, the types of attack have sinister motivation: usually to coax information or open up a system to allow the introduction of malicious plug-ins.

Preventing social engineering attacks requires a number of strategies, including education, alerts and regular monitoring. Testing is also important and should be included within a systematic Test and Exercise schedule

The team at SRM can safely and securely build an attack scenario to test how the organisation would respond to a real and malicious attempt of this nature. The purpose of which is not to embarrass or bring disciplinary action to individuals, but to create an environment where all employees recognise their part in preventing this type of cyber-attack.