RE: Testing the user community

Kurt,

If you really want to test the vulnerability of your users, more power
to you. That is something I am also looking at doing, but be careful
before you start. Make sure that the scope of your assessment is
CLEARLY defined and that your management/superiors are aware and on
board. All that is for covering your 6. As far as methodology goes,
look for information on "Social Engineering" or "pretexting". If you
have some time before you need to execute your plan, I recommend reading
a couple of books by Kevin Mitnick. I am currently reading "The Art of
Deception" which is all about social engineering. It's a fun read,
makes me laugh, but as a security professional, its also scares me to
death. After that you could try reading "The Art of Intrusion" also by
Mitnick. The latter title I have not picked up yet, but I am planning
to when I finish "Deception." Mitnick's books are a good resource,
after all, how many years did he spend in jail for the subject matter?

Good luck, Kurt, I would be interested to hear how you go about it and
what the results are.

Derek Morris

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of webmaster@xxxxxxxxxxxxxxxxxxxx
Sent: Tuesday, January 30, 2007 6:12
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: Testing the user community

We all know our weak link but how do you identify just how weak they
are? I think it's time to pen test my user community and have a couple
ideas to gather statistics on just how nonaware they really are. Maybe a
simple phishing scam and bogus email with a fake virus attachment that
emails me when it's opened so I can track how many folks actually opened
it. Has anyone ever done this before? I can't find any information
about it on the web.. thoughts and ideas anybody?

Many thanks

Kurt



------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=7016
00000008bOW
------------------------------------------------------------------------

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.

http://www.cenzic.com/products_services/download_hailstorm.php?camp=701600000008bOW
------------------------------------------------------------------------

Relevant Pages

  • Re: tools to scan source code
    ... to create a static source code analyser for ASP.net ... app vulnerabilities have a different structure than the vulnerabilities ... Need to secure your web apps? ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: LAN pen test
    ... whithout additional network ... Need to secure your web apps? ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • RE: Fwd: Terminal services and remote programs.
    ... Our team regularly breaks into Terminal Servers ... Need to secure your web apps NOW? ... Cenzic finds more, "real" vulnerabilities ...
    (Pen-Test)
  • RE: Fwd: Terminal services and remote programs.
    ... "help/about vulnerabilities" that were mentioned here a few days ago. ... TerminalServices and RemoteApp deployments, including ... Need to secure your web apps NOW? ...
    (Pen-Test)
  • Re: Pen testing techniques
    ... login form, its far more difficult to secure an app's internals. ... tight on time, and there are no apparent vulnerabilities to target, be ... For web apps I prefer a web app vulnerability scanner ...
    (Pen-Test)