Course 2012 - Social Engineering: Deceptions and Defenses

Description

Course Objectives ► Defend against social engineering deceptions that threaten organizational security ► Plan, execute, and evaluate security assessments for human weaknesses ► Explore the dangers of psychological manipulation ► Measure and report your organization’s preparedness for social engineering attacks ► Implement procedures and policies to defeat deceptions ► Mitigate personnel vulnerabilities with education and security awareness !2012-Front Page Social Engineering: Deceptions and Defenses Copyright Slide Number 3 2012-Chapter 00 Introduction and Overview Slide Number 2 Course Contents Warning! Social Engineering 2012-Chapter 01 Introduction to Social Engineering Slide Number 2 Slide Number 3 Social Engineering Fixing the Problem Terms and Definitions Terms and Definitions Risks An Untrained Mind Is the Vulnerability Social Engineering Threats Assets Types of Social Engineers What Is a Social Engineer? Acceptable Social Engineering Slide Number 15 Learning From Case Studies Examining Case Studies Case Study 1: Elizabeth Moreau Case Study 2: Florida Prison Break Discussion of Case Studies Slide Number 21 Attack Methodologies and Techniques Reconnaissance Understanding the Organization Gaining Physical Access Elicitation Impersonation Pretexting and Persuasion Exit Strategy Slide Number 30 Motif for This Course Tools Used in This Course Slide Number 33 Hands-On Exercise 1.1 Slide Number 35 Review Questions 2012-Chapter 02 Gathering Information Slide Number 2 Slide Number 3 Goals of Information Gathering Organizational Organizational Relational Relational Discussion of Stanley Mark Rifkin Events Technical Physical Slide Number 13 Gathering On-site Information Useful On-site Information Dumpster Diving Gaining Site Access Linking Slide Number 19 Hands-On Exercise 2.1 Slide Number 21 Online Information Sources Technical Information Gathering Open-Source Information Gathering Google Hacking Google Hacking Operators Google Hacking Cheat Sheet Google Hacking Harvesting E-Mail Accounts TheHarvester Password Cracking Basics Online vs. Offline Cracking Non-technical Information Gathering Social, Job, and Business Networks Slide Number 35 Countermeasures User Name and Password Security Online Defenses Minimizing Google Hacking Minimizing Google Hacking Slide Number 41 Review Questions 2012-Chapter 03 Understanding the Communication Model Slide Number 2 Slide Number 3 Communication Models The Berlo Communication Model Source Commonality of Source and Receiver Message Channel Receiver Slide Number 11 Exploiting Communication Weaknesses Confidentiality Integrity Authenticity Authenticity Availability Sources and Receivers Message Vulnerabilities Insecure Channels Insecure Channels Slide Number 22 Hands-On Exercise 3.1 Slide Number 24 Securing Communications Source and Receiver Technical Measures Operational Defenses Management Measures Slide Number 30 Review Questions 2012-Chapter 04 Gaining Physical Access Slide Number 2 Slide Number 3 Physical Security Social Engineers Know Lock Picking Methods of Gaining Access Shoulder Surfing Slide Number 8 Access Controls: Locks Lock Components Simple Mechanical Access Controls Bump Keys Lock Bumping Videos More Simple Mechanical Access Controls High-end Mechanical Access Controls Bumping Medeco Video Electronic Access Controls Skimming Cards Video Smart Cards Other Simple Bypass Techniques Egress = Ingress Look at or Photograph the Key Slide Number 23 Hands-On Exercise 4.1 Slide Number 25 Detection Sensors Evasion CCTV PIR Ultrasonic Detection Other Sensors Slide Number 32 Rating Access Controls Better Access Controls Other Measures Slide Number 36 Review Questions 2012-Chapter 05 Eliciting Information Slide Number 2 Slide Number 3 Eliciting Information Elicitation Vulnerability Interview Steps Planning Controlling the Environment Initial Contact and Greetings Opening Interviewing Closing Slide Number 13 Rapport Social Engineering and Rapport The Result of Having Rapport Building Rapport Pacing by Matching and Mirroring Lingo Leads to Rapport Leading Slide Number 21 Elicitation Tactics and Goals Elicitation Tactics Elicitation Tactics Elicitation Tactics Elicitation Tactics Elicitation Tactics Elicitation Goals Examples of Organizational Information Useful Personal Information Useful Personnel Information Useful Technical Information Useful Physical Site Information Slide Number 34 Hands-On Exercise 5.1 Slide Number 36 Halting Information Loss Situational Awareness Scripting Scripting Least Privilege and Need to Know Slide Number 42 Review Questions 2012-Chapter 06 Impersonation Slide Number 2 Slide Number 3 Impersonation Impersonation Requirements Impersonation Vectors Slide Number 7 In-Person Impersonation Disguises Discussion: How to Rob a Bank Change Blindness Slide Number 12 Hands-On Exercise 6.1 Slide Number 14 Remote Impersonation Client-Side Attacks Clickjacking Clickjacking Browser Popups and Phishing Spearphishing and Whaling Blogs and URL Shortening Cloning a Website SET Credential Stealing Credential Stealing Telephone and Fax Social Media and Career Sites Slide Number 28 Deceiving Authentication Systems Authentication Methods User Name and Password Keyloggers Sniffing and MiTM Ettercap MitM With Ettercap Modifying Data With Ettercap Authentication Tokens Biometrics Bypassing Facial Recognition Slide Number 40 Indirect Impersonation Indirect Impersonation Reverse Social Engineering Slide Number 44 In-person Impersonation Remote Impersonation Authentication Authentication Systems Indirect Impersonation Slide Number 50 Review Questions Review Questions 2012-Chapter 07 The Psychology of Persuasion Slide Number 2 Slide Number 3 Pretexting and Manipulating Behavior Robert Cialdini’s Motivators* Reciprocity Scarcity Act Now! Greed Also Works The Dollar Auction* Commitment and Consistency Trust Survey Liking The Halo Effect Slide Number 15 Mindlessness The Roots of Mindlessness Everyday Examples of Mindlessness Interpreting and Recognizing Exploiting Mindlessness The Yes Set Performing Math Use of a Yes Set Slide Number 24 Social Proof Why Social Proofing Occurs Debriefing Previous Assignments Authority Why We Yield to Perceived Authority Recognizing Authority Authority Need Not Be Stated Authority and Social Proofing The Milgram Experiment Slide Number 34 Defending Against Human Nature Developing Situational Awareness Recognizing Risky Situations Slide Number 38 Review Questions 2012-Chapter 08 Countermeasures Slide Number 2 Slide Number 3 Assessing Vulnerability Outline of a Penetration Test Outline of a Penetration Test Examples of Pentest Elements Skills Needed Skills Needed Slide Number 10 Legal and Social Concerns Impersonation and Disguises Marking vs. Stealing Slide Number 14 Hands-On Exercise 8.1 Slide Number 16 Developing Policies Social Engineering Audits Are Necessary Verification Policies Social Media, Career Sites, and Blogs Slide Number 21 Building Awareness Key Awareness Talking Points Key Personnel Mistakes Slide Number 25 Review Questions Review Questions 2012-Chapter 09 Course Summary Slide Number 2