OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
RE: Penetration Testing - Human Factor

From: Arian J. Evans (arian.evansanachronic.com)
Date: Mon Aug 21 2006 - 23:46:01 CDT

I've seen nothing quantifiable.

FWIW - every forensic engagement I have done of "true"
hacking has had nothing to do with social engineering,
and was entirely technical. Most appeared to be performed
by SKiddies, but at least one was very subtle, and was
performed by someone with real skill.

I do see a biased sample though, since people do not
generally come to me after they've been socially
engineered, unless it's a girl I've dated.

Your first statement does raise the question though
about how does a skeptic conclude something before
they gather evidence?

Arian J. Evans

> -----Original Message-----
> From: Marios A. Spinthiras [mailto:marionetway.com.cy]
> Sent: Monday, August 21, 2006 1:20 AM
> To: pen-testsecurityfocus.com
> Subject: Penetration Testing - Human Factor
>
> As a thorough sceptic Id like to conclude in most cases of a
> TRUE hacking
> incident social engineering has been a factor of success for
> the malicious
> user attacking a system.
> For quite a while now I have been compiling methodology on the
> assessment of the weak human security link which can be
> exploited through
> social engineering. Has anyone got any thoughts they would
> like to share or
> guidelines to the audit of the human factor when security is
> concerned?
>
> Any information is much apreciated.
>
>
> Many Thanks,
> Mario A. Spinthiras
>
>
> --------------------------------------------------------------
> ----------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> --------------------------------------------------------------
> ----------

------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------