Social Engineering and Anti Phishing Email Testing

In cybersecurity, social engineering is a breach tactic, which involves using deception in order to gain access or information that will be used for malicious purposes. The most common example of this is seen in phishing scams. Phishing is typically used for one of two purposes. 

Attackers could be trying to sneak malicious code past the perimeter. A target would receive an email, usually made to look like it comes from somewhere or someone familiar, like a commonly visited website or a colleague. Upon clicking a link or attempting to open an attachment in an email, malware would be released into the entire organization. This malware could be used for any number of reasons, like creating a backdoor that the threat actor can then use to access the network. 

Alternately, a user may receive an email that appears as though it is from somewhere trustworthy that requires a login, like a bank. The email would prompt a user to call a phony telephone number, or would lead to an authentic looking website, and would prompt a user to share their credentials, which can then be used for further attacks. 

Social engineering testing imitates such phishing campaigns in order to safely determine whether your employees are vulnerable to phishing, and what types of phish are most likely to fool them. Pen testers should create a diverse campaign, deploying emails that are of varying degrees of difficulty. Some could be similar to those actually being used by threat actors in the wild, others may be carefully researched and crafted to target an organization or person specifically. Users that click or enter credentials are not served with malware, but are instead tracked, and potentially flagged for additional training. By frequently having pen testers deploy phishing email tests, employees will become more discerning, taking their time to scrutinize an email before trusting its authenticity.