A few weeks ago I had the honor of delivering the keynote address at BSidesDFW on defending against social engineering attacks. I’ve spent most of my infosec career teaching others how to perform these attacks, but not much about defending against them. So I decided to change things up a bit. Welcome to my first defense-based posting.
As a security consultant I’ve performed social engineering assessments for a multitude of clients– from ecommerce to government and everything in between. Each engagement is unique, but almost always results in the same question from management: “How do we stop social engineering attacks?” I found that I didn’t have a definitive resource to refer them to, or even a high-level guideline to get them started.
The simple truth is social engineering attacks can’t be stopped with technology alone; nor can they can’t be stopped with training alone. I created the Social Engineering Defensive Framework (SEDF) to help organizations prevent social engineering attacks at the enterprise level. SEDF outlines basic phases for attack prevention.
– Determine exposure
– Evaluate defenses
– Educate the workforce
– Streamline existing technology
– Implement an incident response plan
The SEDF phases are independent from each other and can be performed in an order that suits the priorities of the organization. If you’ve just completed a large training campaign, then perhaps evaluating defense is the next step for you.
Determine Exposure
This phase focuses on seeing websites and other available resources through the eyes of a social engineer. A web exposure assessment is a non-intrusive method of gathering client information in order to provide a clear picture on what data is exposed to the Internet.
A major area of focus is the company website. Are you providing too much information? An online employee directory, while helpful to customers, is a goldmine for social engineers. In most cases, listing key customer-focused employees provides customers with the point of contact without listing everyone who works at the company. Superfluous job postings can provide details about software deployed in your environment. Announcing your brand of antivirus and other deployed security technologies to the world is like putting out the welcome mat for attackers. Metadata analysis is a key part of the assessment to determine if usernames, passwords, and operating system details are exposed in documents that are posted on your website.
Another portion of the assessment is searching for leaked documents. Not all of these documents are discovered via Google. Peer-to-peer networks, social media, and other information sharing websites can be excellent resources. Whenever I perform one of these assessments and attach the discovered documents the client always asks, “Where did you get this!?”
A few other areas of focus are:
– Technical support forums – You’d be surprised how many folks register for these using their company email address. Code snippets and file paths can be very helpful when planning a technical attack.
– Social media – These resources provide insight into the lives of employees, and are fertile hunting ground for attackers. Personal details such as what high school they attended or pet names are often used as password reset questions. Also, knowing if someone is going to be on vacation for a week provides an attacker the opportunity to masquerade as that employee with minimal risk of detection.
– Popular hacking websites – Sites like http://pastebin.com are popular dumping ground for attackers and can contain everything from account data to intellectual property.
Once the research is complete a report is made summarizing the discovered information and the most likely attack vectors. For some companies this can be quite an eye opening experience. In addition to listing attack vectors, recommendations are included on how to reduce exposure of the discovered data.
In the weeks to come I’ll be discussing the additional phases for SEDF. Stay tuned for updates!
Valerie Thomas | Senior Information Security Consultant |Securicon, LLC | @hacktress09
Valerie Thomas (hacktress09) is a Senior Information Security Consultant for Securicon LLC that specializes in social engineering and physical penetration testing. After obtaining her bachelor’s degree in Electronic Engineering, Valerie led information security assessments for the Defense Information Systems Agency (DISA) before joining private industry. Throughout her career, Valerie has conducted penetration tests, vulnerability assessments, compliance audits, and technical security training for executives, developers, and other security professionals. Additionally, Valerie has presented and trained at multiple BSides events, Derbycon, Black Hat, Defcon, HackMiami, and several other conferences.
