Hacking the human: social engineering techniques and security countermeasures

267 Pages·2008·1.55 MB·English

by  Ian Mann

Hacking the Human
This book is dedicated to
Ravinder, Alec, Oscar, and Mia
Hacking the Human
Social Engineering Techniques and
Security Countermeasures
IAN MANN
© Ian Mann 2008
All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted
in any form or by any means, electronic, mechanical, photocopying, recording or otherwise without the prior
permission of the publisher.
Published by
Gower Publishing Limited
Gower House
Croft Road
Aldershot
Hampshire GU11 3HR
England
Gower Publishing Company
Suite 420
101 Cherry Street
Burlington, VT 05401-4405
USA
Ian Mann has asserted his moral right under the Copyright, Designs and Patents Act, 1988, to be identified
as the author of this work.
www.gowerpublishing.com
British Library Cataloguing in Publication Data
Mann, Ian
Hacking the human : social engineering techniques and
security countermeasures
1. Social engineering 2. Social systems - Planning
3. Business enterprises - Security measures
I. Title
658.4’7
ISBN: 978-0-566-08773-8
Library of Congress Cataloging-in-Publication Data
Mann, Ian.
Hacking the human : social engineering techniques and security countermeasures / by Ian Mann.
p. cm.
Includes index.
ISBN 978-0-566-08773-8
1. Social engineering. 2. Social systems--Planning. I. Title.
HM668.M36 2009
658.4’7--dc22
2008019977
Contents
List of Figures ix
Introduction 1
SECTION 1: THE RISKS
Chapter 1 What is Social Engineering? 11
Social Engineering Threats 15
Measurement of Security Controls 20
Chapter 2 Understanding Your Risks 23
Defining Social Engineering Risk 23
Foundation Approach 32
Standardized Approach 33
Quantitative Approach 36
Chapter 3 People, Your Weakest Link 39
Social Engineering Vulnerabilities 39
The Risks Associated with Vulnerabilities 43
A(cid:1)acking CriticalX 46
Chapter 4 Limitations to Current Security Thinking 63
Information Security Vendors 63
Organizational Structure 63
Security Professionals 64
The Adventures of HackerZ – continued … 66
SECTION 2: UNDERSTANDING HUMAN VULNERABILITIES
Chapter 5 Trust Me 87
Trusting the A(cid:1)acker 89
Tricks to Building Rapport 91
vi HACKING THE HUMAN
Chapter 6 Reading a Person 97
Mind Reading 97
Personality Profiling 99
Chapter 7 Subconscious Mind 115
Neuro-Linguistic Programming (NLP) Profiling 115
Understanding the Subconscious 117
The Power of Commands 124
Hypnotic Language 130
Be(cid:1)er Model of the Mind 131
Enhanced Personality Profiling 132
Chapter 8 Parent, Adult, Child 137
Roles for the Social Engineer 137
Applying Transactional Analysis 141
SECTION 3: COUNTERMEASURES
Chapter 9 Vulnerability Mapping 155
Comparing System Strength 157
Mapping your Systems 160
Personality Profiling Techniques 162
Chapter 10 Protection Systems 167
Building Systemic Improvements 168
Social Engineering Model of Protection 176
Mapping A(cid:1)ack and Protection Combinations 177
Access Controls 186
Chapter 11 Awareness and Training 195
Awareness-Building Activities 195
Targeting Awareness and Training 200
Social Engineering Awareness Building Strategies 203
Chapter 12 Testing 211
Levels of Progression 211
Social Engineering Testing Methodology 213
Get Out of Jail Free Cards 216
Targeted Testing 221
The Power of the Cardboard Box – A Typical Testing
Assignment 222
CONTENTS vii
Developing Stronger Systems 231
Final Thoughts 233
Further Reading 235
Index 247
This page intentionally left blank
List of Figures
I.1 Human security – the missing link 2
2.1 Foundation approach to risk assessment 32
2.2 Standardized approach to risk assessment (ISO 27001
compliant) 35
2.3 Quantitative approach to risk assessment (ISO 27001
compliant) 36
6.1 Personality profiles 100
6.2 Personality profile driving forces and roles 103
6.3 Typical departments mapped to personality profiles 103
7.1 NLP eye movement reading 115
7.2 Conscious–subconscious brain relationship 120
7.3 Advanced model of the mind 132
7.4 Personality profiles tendency to comply or challenge 133
7.5 Psychological analysis of a phishing a(cid:1)ack 135
8.1 Transactional analysis ego states 144
8.2 Transactional analysis transaction diagram 146
8.3 Crossed transaction 148
8.4 Using TA to map hidden communication 151
9.1 Social engineering system strength mapping 157
9.2 Personality profiles’ tendency to comply or challenge 162
10.1 Social engineering model of protection 177
10.2 Mapping a(cid:1)acks and countermeasures to the model of
protection 178
10.3 Extending the social engineering model of protection 180
10.4 Hacking a(cid:1)ack vectors for biometric systems 191