From the course: Performing a Technical Security Audit and Assessment

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Conduct social engineering

Conduct social engineering

From the course: Performing a Technical Security Audit and Assessment

Start my 1-month free trial Buy for my team

Conduct social engineering

“

- [Instructor] Social engineering is a tactic used by security assessors to trick people into disclosing sensitive information. The information they're going after often includes usernames, passwords, and other sensitive data, such as credit card or social security numbers. Attackers can conduct social engineering in a variety of ways, including face-to-face, or over the phone through simple lying, also called pretexting, malicious websites using phishing, email, using phishing or spear phishing, and text, or instant messages, also known as smishing. Conducting social engineering during a security assessment evaluates the effectiveness of an organization's security awareness training. Successful breaches during the assessment should be documented as findings. A recommended remediation could be to improve user security training or increase its frequency. On the other hand, failed social engineering attempts are a positive result, and assessors should note that in the final report. Lisa…

Contents