Our Approach and
Methodology
The SecureState Profiling Team are well known and highly regarded as
experts in Penetration Testing and Social Engineering. Our approach
follows industry accepted testing methodologies such as
PTES,
NIST 800-115,OSSTMM and the
Social Engineering Framework. By following these methodologies, our
clients can accurately replicate the testing SecureState has performed
in their own environment to accurately mitigate identified
vulnerabilities. The SecureState Profiling Team also helps identify
strategic “root cause” issues through our Penetration Tests. Our Risk
Management Team is uniquely positioned to work closely with the
Profiling Team in order to assist clients with mitigating these
strategic “root cause” issues.
Phase I – Pre-engagement Interactions:
In this phase, SecureState works with the client to establish the
rules of engagement as well as the scope and exchange contact
information for both parties. SecureState provides a detailed Project
Charter which contains information on scope and everything that will be
required to conduct the testing. The Project Charter is discussed during
the kickoff call prior to the beginning of the engagement.
Phase II – Intelligence Gathering:
SecureState begins any Social Engineering Assessment by conducting an
extensive search of open source intelligence on the target company and
its employees. This research locates information regarding the target
company and its employees from public databases, tax records, job
openings, social networks, Internet search engines and much more. If the
Social Engineering is to be performed on-site, Dumpster Diving can also
be performed to gather intelligence about the specific target.
Also in this phase, SecureState begins to develop scenarios tailored
toward the target company and employees. These scenarios are based off
of the intelligence that was gathered previously in this phase.
Phase III – Pretexting:
Pretexting is all about creating a scenario which will convince the
victim to click on a link to visit a web site, or take some form of
action. In some cases, this can involve an elaborate scenario which
includes impersonating current or former employees. For example,
SecureState can create a website to elicit user account credentials to a
web mail system. Our staff members have the ability to call an employee
while impersonating a help desk worker to solicit account credentials.
Once SecureState Team Members has these credentials, they can login and
gather additional information about the victim and company. Another
example is crafting a highly convincing phishing email that is sent to
multiple employees. The email appears to originate from the target
company. These types of examples simulate real attacks
that have lead to security breaches in the recent past. We can also
create custom scenarios based on any threats identified in Phase I.
Phase IV – Exploitation:
Once the pretexting phase is complete, the exploitation phase begins.
SecureState sends emails, makes phone calls and drops CDs and USB Thumb
Drives using the pretexting scenarios previously developed. For
scenarios like email phishing and CD and USB Thumb Drive drops, the
client can determine how far SecureState should take the social
engineering. For example, some clients may only want us to track whether
or not employees clicked the link in a phishing email. Other clients may
want us to attempt at full remote access to an employee’s workstation
after clicking on a link or putting a USB Thumb Drive into their
computer.
Phase V – Post Exploitation:
The Post Exploitation Phase includes pillaging, penetrating further
into the network, documentation and cleaning up any remains from
SecureState’s testing on the clients systems.
Phase VI – Reporting:
As part of the deliverable, SecureState provides a report which
contains a short graphical summary aimed at senior management, a
narrative body which details major findings and a detailed findings
section aimed at technical staff. SecureState also provides a closing
call and high level executive presentation to summarize the penetration
test; as well as provide an opportunity to ask questions about the
engagement.