RE: Penetration Testing - Human Factor

I've seen nothing quantifiable.

FWIW - every forensic engagement I have done of "true"
hacking has had nothing to do with social engineering,
and was entirely technical. Most appeared to be performed
by SKiddies, but at least one was very subtle, and was
performed by someone with real skill.

I do see a biased sample though, since people do not
generally come to me after they've been socially
engineered, unless it's a girl I've dated.

Your first statement does raise the question though
about how does a skeptic conclude something before
they gather evidence?

Arian J. Evans

-----Original Message-----
From: Marios A. Spinthiras [mailto:mario@xxxxxxxxxxxxx]
Sent: Monday, August 21, 2006 1:20 AM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: Penetration Testing - Human Factor

As a thorough sceptic Id like to conclude in most cases of a
TRUE hacking
incident social engineering has been a factor of success for
the malicious
user attacking a system.
For quite a while now I have been compiling methodology on the
assessment of the weak human security link which can be
exploited through
social engineering. Has anyone got any thoughts they would
like to share or
guidelines to the audit of the human factor when security is
concerned?

Any information is much apreciated.


Many Thanks,
Mario A. Spinthiras


--------------------------------------------------------------
----------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
--------------------------------------------------------------
----------


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------

Relevant Pages

  • Re: Penetration Testing - Human Factor
    ... Arian how have you concluded that no evidence has been gathered? ... I do not know how serious you consider social engineering to be but if you have not spent time with it please do so, I can offer you a lot of material regarding this issue. ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • RE: Penetration Testing - Human Factor
    ... I think that's a greater commentary on your contracting ... The Pen-Tests I have run include ... social engineering on the radar at all, ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • RE: Penetration Testing - Human Factor
    ... other data to compare the social engineering numbers to. ... Cenzic Hailstorm finds vulnerabilities fast. ... Click the link to buy it, try it or download Hailstorm for FREE. ...
    (Pen-Test)
  • RE: Penetration Testing - Human Factor
    ... engineering...and most were successful. ... "I dare do all that may become a man; Who dares do more is none." ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Penetration Testing - Human Factor
    ... We've offered clients social engineering attacks as part of pen-tests, ... > Cenzic Hailstorm finds vulnerabilities fast. ... > Click the link to buy it, try it or download Hailstorm for FREE. ...
    (Pen-Test)