Cargando…
Social engineering penetration testing : executing social engineering pen tests, assessments and defense /
Social engineering attacks target the weakest link in an organization's security-human beings. Everyone knows these attacks are effective, and everyone knows they are on the rise. Now, Social Engineering Penetration Testing gives you the practical methodology and everything you need to plan and...
| Clasificación: | Libro Electrónico |
|---|---|
| Autor principal: | |
| Otros Autores: | , |
| Formato: | Electrónico eBook |
| Idioma: | Inglés |
| Publicado: |
Burlington :
Elsevier Science,
2014.
|
| Temas: | |
| Acceso en línea: | Texto completo |
MARC
| LEADER | 00000cam a2200000 a 4500 | ||
|---|---|---|---|
| 001 | SCIDIR_ocn878263510 | ||
| 003 | OCoLC | ||
| 005 | 20231120111559.0 | ||
| 006 | m o d | ||
| 007 | cr cnu---unuuu | ||
| 008 | 140426s2014 ne ob 001 0 eng d | ||
| 040 | |a EBLCP |b eng |e pn |c EBLCP |d N$T |d OPELS |d OCLCF |d OCLCQ |d DEBSZ |d OCLCQ |d MERUC |d UUM |d U3W |d D6H |d OTZ |d OCLCQ |d LQU |d OCLCQ |d S2H |d OCLCO |d OCLCQ |d OCLCO | ||
| 019 | |a 1105182082 |a 1105574934 |a 1142824989 | ||
| 020 | |a 9780124201828 |q (electronic bk.) | ||
| 020 | |a 0124201822 |q (electronic bk.) | ||
| 035 | |a (OCoLC)878263510 |z (OCoLC)1105182082 |z (OCoLC)1105574934 |z (OCoLC)1142824989 | ||
| 050 | 4 | |a HM668 |b .W38 2014eb | |
| 072 | 7 | |a SOC |x 000000 |2 bisacsh | |
| 082 | 0 | 4 | |a 303.3/72 |2 23 |
| 100 | 1 | |a Watson, Gavin, |d 1982- | |
| 245 | 1 | 0 | |a Social engineering penetration testing : |b executing social engineering pen tests, assessments and defense / |c Gavin Watson, Andrew Mason, Richard Ackroyd. |
| 260 | |a Burlington : |b Elsevier Science, |c 2014. | ||
| 300 | |a 1 online resource | ||
| 336 | |a text |b txt |2 rdacontent | ||
| 337 | |a computer |b c |2 rdamedia | ||
| 338 | |a online resource |b cr |2 rdacarrier | ||
| 520 | |a Social engineering attacks target the weakest link in an organization's security-human beings. Everyone knows these attacks are effective, and everyone knows they are on the rise. Now, Social Engineering Penetration Testing gives you the practical methodology and everything you need to plan and execute a social engineering penetration test and assessment. You will gain fascinating insights into how social engineering techniques-including email phishing, telephone pretexting, and physical vectors- can be used to elicit information or manipulate individuals into performing actions that. | ||
| 588 | 0 | |a Print version record. | |
| 504 | |a Includes bibliographical references and index. | ||
| 505 | 0 | |a Front Cover -- Social Engineering Penetration Testing -- Copyright Page -- Contents -- Foreword -- Acknowledgements -- About the Authors -- About the Technical Editor -- 1 An Introduction to Social Engineering -- Introduction -- Defining social engineering -- Examples from the movies -- Sneakers -- Hackers -- Matchstick Men -- Dirty Rotten Scoundrels -- The Imposter -- Famous social engineers -- Kevin Mitnik -- Frank Abagnale -- Badir brothers -- Chris Hadnagy -- Chris Nickerson -- Real-world attacks -- The RSA breach -- The Buckingham Palace breach -- The Financial Times breach -- The Microsoft XBox breach -- Operation Camion -- Summary -- 2 The Weak Link in the Business Security Chain -- Introduction -- Why personnel are the weakest link -- Secure data with vulnerable users -- The problem with privileges -- Data classifications and need to know -- Security, availability, and functionality -- Customer service mentality -- Poor management example -- Lack of awareness and training -- Weak security policies -- Weak procedures -- Summary -- 3 The Techniques of Manipulation -- Introduction -- Pretexting -- Impersonation -- Baiting -- Pressure and solution -- Leveraging authority -- Reverse social engineering -- Chain of authentication -- Gaining credibility -- From innocuous to sensitive -- Priming and loading -- Social proof -- Framing information -- Emotional states -- Selective attention -- Personality types and models -- Body language -- Summary -- 4 Short and Long Game Attack Strategies -- Introduction -- Short-term attack strategies -- Targeting the right areas -- Using the allotted time effectively -- Common short game scenarios -- Long-term attack strategies -- Expanding on initial reconnaissance -- Fake social media profiles -- Information elicitation -- Extended phishing attacks -- Gaining inside help -- Working at the target company. | |
| 505 | 8 | |a Targeting partner companies -- Long-term surveillance -- Summary -- 5 The Social Engineering Engagement -- Introduction -- The business need for social engineering -- Compliance and security standards -- Payment Cards Industry Data Security Standard -- ISO/IEC 27000 information security series -- Human Resource Security, Domain 8 -- Physical and Environmental Security, Domain 9 -- Social engineering operational considerations and challenges -- Challenges for the social engineers -- Less mission impossible, more mission improbable -- Dealing with unrealistic time scales -- Dealing with unrealistic time frames -- Taking one for the team -- Name and shame -- Project management -- Challenges for the client -- Getting the right people -- Legislative considerations -- The Computer Misuse Act 1990 (UK)-http://www.legislation.gov.uk/ukpga/1990/18 -- Section 1-Unauthorized access to computer material -- Section 2-Unauthorized access with intent to commit or facilitate commission of further offenses -- Section 3-Unauthorized acts with intent to impair or with recklessness as to impairing, operation of computer, etc. -- The Police and Justice Act 2006 (UK)-http://www.legislation.gov.uk/ukpga/2006/48/contents -- Making, supplying, or obtaining articles for use in computer misuse offenses -- Regulation of Investigatory Powers Act 2000 (UK)-http://www.legislation.gov.uk/ukpga/2000/23/introduction -- The Human Rights Act 1998 (UK)-http://www.legislation.gov.uk/ukpga/1998/42/contents -- Right to respect for private and family life -- Computer Fraud and Abuse Act-United States -- Social engineering frameworks -- Pre-engagement interactions -- Intelligence gathering -- Threat modeling -- Exploitation -- Post exploitation -- Primary objective (exploitation) -- Secondary objectives (post exploitation) -- Reporting -- Assessment prerequisites -- Scoping documents. | |
| 505 | 8 | |a Contact details -- Type of testing -- Scope limitations -- Get out of jail free -- Key deliverables -- The debrief -- Debrief key points -- The report -- Written report key points -- Social engineering team members and skill sets -- The generalist -- Key attribute(s) -- The ethical hacker -- Key attribute(s) -- The burner -- The social engineer -- Key attribute(s) -- The scout -- Key attribute(s) -- The thief -- Key attribute(s) -- Summary -- 6 Ensuring Value Through Effective Threat Modeling -- Introduction -- Why the need for threat modeling? -- Gain access to my underground bunker data center -- Consultant led threat modeling -- What? -- Why? -- Who? -- Where? -- How? -- What? -- Why? -- Who? -- Where? -- How? -- Plugging into the Information Assurance and Risk Management processes -- Gather information using open-source discovery of organizational information -- Perform reconnaissance and surveillance of targeted organizations -- Craft phishing attacks -- Craft spear phishing attacks -- Create counterfeit/spoof web site -- Deliver malware by providing removable media -- Exploit physical access of authorized staff to gain access to organizational facilities -- Conduct outsider-based social engineering to obtain information -- Conduct insider-based social engineering to obtain information -- Obtain information by opportunistically stealing or scavenging information systems/components -- Who would want to gain access to my business? -- State-sponsored/terrorist groups -- Organized crime groups -- Trouble causers, hobbyists, and lone gunmen -- Other players -- Summary -- 7 Creating Targeted Scenarios -- Introduction -- The components of a scenario -- Target identification -- Open-source reconnaissance -- Target profiling -- Physical reconnaissance -- Target engagement -- Pretext design mapping -- Planning for the unknown -- Scenario specific outcomes. | |
| 505 | 8 | |a Cover stories -- Exit strategies -- Designing to fail -- Summary -- 8 Leveraging Open-Source Intelligence -- Introduction -- The corporate website -- Business purpose -- Partners, clients, vendors -- E-mail addresses -- Employee names -- Staff hierarchy -- Phone numbers -- Photos of employees and business locations -- Spidering -- Passive Spider -- Active spidering with OWASP Zed Attack Proxy -- Why is this information useful to a social engineer? -- Document metadata -- Strings -- FOCA-http://www.informatica64.com/foca.aspx -- Metagoofil -- Why document metadata is useful to social engineers -- Photographic metadata -- Exiftool-http://www.sno.phy.queensu.ca/~phil/exiftool/ -- Image Picker-a Firefox add-on-https://addons.mozilla.org/en-us/firefox/addon/image-picker/ -- Using Wget to download images from a site -- GeoSetter-http://www.geosetter.de/en/ -- Reverse image search engines -- Not so metadata -- PDFGrep-http://pdfgrep.sourceforge.net -- Document obfuscation -- The Way Back Machine-http://archive.org/web/web.php -- E-mail addresses -- Phishing attacks -- Password attacks -- Insider knowledge -- E-mail address conventions -- theharvester-https://code.google.com/p/theharvester/ -- FOCA -- Metagoofil -- Whois -- Sam Spade -- Jigsaw -- Recon-ng-https://bitbucket.org/LaNMaSteR53/recon-ng-also includes a handful of Jigsaw modules -- Social media -- LinkedIn -- Recon-ng-https://bitbucket.org/LaNMaSteR53/recon-ng -- Facebook -- Twitter -- Recon-ng -- DNS records -- Dnsrecon-https://github.com/darkoperator/dnsrecon-Twitter-@Carlos_Perez -- Subdomain brute forcing -- CeWL-http://www.digininja.org/projects/cewl.php -- Whois records -- Making use of the intel -- Summary -- 9 The E-mail Attack Vector -- Introduction -- An introduction to phishing attacks -- Why phishing attacks work -- The client-side attack -- Spear phishing versus trawling -- Trawling. | |
| 505 | 8 | |a Spear phishing -- Real-world phishing examples -- American Express-drive-by-download -- Dr. Atanasoff Gavin-advance fee fraud -- Apple ID scam-credential harvesting -- Nobody falls for this one. Nobody. Ever. -- Active e-mail reconnaissance -- Nondelivery reports -- Out-of-office responses -- The nonexistent meeting -- Impersonating the absent staff member -- Creating plausible e-mail scenarios -- Work experience placements -- Weaponizing the scenario -- The college project -- Weaponizing the scenario -- The recruitment consultant -- Salesperson -- Defending against phishing attacks -- Technological approaches -- Spam and antivirus products at the gateway, mail server, and the endpoint or client machine -- Host based intrusion preventions or "HIPS" products, and network based intrusion prevention systems -- Client application patching -- Outbound content filtering-firewalls and proxies -- Human approaches -- Setting up your own attack -- Spoofed e-mails versus fake domain names -- The SET -- Spear phishing attack vector -- Does this approach really work? -- Malicious Java applets -- Using cloned web sites to harvest credentials -- Is all of this really social engineering? -- Summary -- 10 The Telephone Attack Vector -- Introduction -- Real-world examples -- Kevin Mitnick -- Card cancelation scams -- Environmental sounds -- The issues with caller ID -- Caller ID spoofing -- Phone system hacks -- Is the contact database up to date? -- Transferring caller ID -- How to figure out if your caller ID shows up -- Summing it up -- Building on the e-mail attack -- Please contact Sarah in my absence -- Who ya gonna call? -- Job enquiries -- Sales calls -- Surveys -- Impersonating staff members -- The help desk -- Employee numbers -- Obtaining key information and access -- Credentials and e-mail access -- Physical access -- The physical access zero day. | |
| 650 | 0 | |a Social engineering. | |
| 650 | 6 | |a Ing�enierie sociale. |0 (CaQQLa)201-0198186 | |
| 650 | 7 | |a SOCIAL SCIENCE |x General. |2 bisacsh | |
| 650 | 7 | |a Social engineering |2 fast |0 (OCoLC)fst01122444 | |
| 700 | 1 | |a Mason, Andrew. | |
| 700 | 1 | |a Ackroyd, Richard. | |
| 776 | 0 | 8 | |i Print version: |a Watson, Gavin. |t Social engineering penetration testing. |d Burlington : Elsevier Science, 2014 |z 9780124201828 |
| 856 | 4 | 0 | |u https://sciencedirect.uam.elogim.com/science/book/9780124201248 |z Texto completo |