DO YOU KNOW WHERE
YOUR WEAKEST LINK IS?
A Cybersecurity Must Have
The #1 cybersecurity threat for businesses is social engineering attacks. These types of attacks will be at the top for a long time to come.
Social engineering attacks, which rely on human interaction and fraudulent behavior to trick people, are the driving force behind spear phishing, email compromises, and ransomware.
We view social engineering campaigns as a must-have service for every business and organization. And it’s why we offer social engineering assessments for:
- Email phishing,
- Telephone/text,
- and onsite/social pretexting
Use your mouse to hover over the pie chart and see your industry’s %’s of breaches.
The Human Factor
in IT Security
Employee actions lead to cybersecurity incidents. Although traditional cybersecurity attacks leverage technology-based system vulnerabilities, such as misconfigurations and software bugs, social engineering attacks take advantage of human nature and the inherit vulnerabilities in people.
Unethical Hackers use deception in order to trick targeted victims into performing acts that are harmful to a company’s network.
At MainNerve, we make the social engineering process painless and simple. Our team has conducted (and successfully delivered) numerous social engineering assessments for businesses of all sizes and types… and we can help you protect your company from the insider threat (your employees).
A social engineering campaign can be used as a one-time method of assessing the effectiveness of a security awareness training, or to support new and current training programs. Using the latest intelligence on social engineering techniques, a social engineering test can evaluate employees against general phishing and “spear-phishing” attacks that are intended to exploit trust and lack of security awareness.
At MainNerve, we offer two different types of social engineering tests. Those are Phishing Email Attacks and Phishing Data Attacks.
Deploys a distinct simulated phishing email to test whether employees click on malicious links that they should not. It is a single test where no exploitation occurs but only collects general information on the effectiveness of the attack and the employee’s response.
Tests user security awareness by manipulating individuals in your organization to perform unsafe actions or provide sensitive information over email. The content used in these scenarios ranges from generic, spam-like messages to client-specific emails that are designed to appear to originate from internal users, third-party service providers, or clients.
The MainNerve Process
Process
With MainNerve, you’ll receive a customized approach to your social engineering test. Depending on how much your budget is and how much information you want to provide, we can tailor the test to your needs.
- Understand the risk posed to you, and your customers, by uneducated empoyees.
Social Engineering Tests
Customer Provided Information, or Not
We will need to determine how we will get the emails for testing. We have two methods for that.
A list of email addresses of the employees targeted is provided by the customer. Additionally, the customer may provide information that can help with the targeting, such s programs used or companies they work with. This type of social engineering test represents the simpler and quicker method, as research is not required in order to build a list.
A list of employees' email addresses is not provided to MainNerve, resulting in a lot of manual research on our part. Research includes employing tools and techniques for harvesting names and email addresses from open-source directories, social media sites, and customer websites. This extra research will incur additional costs.
Deliverables
MainNerve will prepare a final report detailing the results of the social engineering test. The report will, if relevant to the current project, contain the following sections:
- Executive Summary
- Testing Overview
- Final Results
- Risk Rating
Deliverables will be provided via secure file transfer service by MainNerve. All final deliverables are shared only with approved parties.
MainNerve Methodology
The planning stage of the social engineering test will include communication with the key points of contact. MainNerve will address the scope of the project to include project objectives and limitations. We will provide rules of engagement (ROE) before work begins.
MainNerve will obtain information on the targeted employees. Then we will use industry-approved tools and techniques to build out pretexts (email campaigns) that will simulate a malicious attacker either trying to get your employees to click a link, or to provide credentials.
MainNerve will send the emails we created in the prior phase and monitor for traffic. The test will continue for a predetermined length of time.
Considered the most important step in penetration testing, our reports relay all findings in a thorough and clear manner. This includes technical findings, screen captures as proof of risk, remediation recommendations, and risk ratings.
blogs about
Social Engineering
