Going white hat: Security check by hacking employees using social engineering techniques

Abstract

Information security is built on top of three basic building blocks: people, processes and technology. Even when organization has very refined processes and state of the art technology, people usually remain the weakest link in the security chain. Social engineering is the practice of obtaining confidential information or valuable assets by manipulation of legitimate users or owners. Large telecommunication companies, having large customer base and a broad collection of sensitive data, present a very interesting target for social engineering attacks. In order to identify the risks for the business, penetration testing can be used as a method for determining organizational resilience against malicious attack attempts. Usually these tests are done using technical methods, but non technical methods like social engineering can also be employed. In this paper we present a case study of a penetration test using social engineering techniques targeting a large telecommunication in Croatia. We describe the preparation process, techniques used for testing, results and lessons learned.