discussion board

reply to:

1.Is Social Engineering Ethical?
Shanteal Whitfield posted Mar 20, 2020 9:56 PM
This page automatically marks posts as read as you scroll.Adjust automatic marking as read setting
This was a great article to read. After reading the article, I found this article to be very interested and I learned some key points about social engineering and penetration test. Social engineering is a form of techniques employed by cybercriminals designed to lure unsuspecting users into sending them their confidential data, infecting their computers with malware or opening links to infected sites [1]. A penetration test (pen test) is a simulated cyber attack against your computer system to check for exploitable vulnerabilities [2]. I agree with him that any system can be compromised. Look at some companies that have been compromised the past few years. A big one that standouts that I have heard people talking about is OPM. Social engineering can easily go wrong and not produce good results. My takeaway from this article is that social engineering can be very risky and inappropriate behavior.

[1] Usa.kaspersky.com. 2020. [online] Available at: <https://usa.kaspersky.com/resource-center/definitions/social-engineering> [Accessed 21 March 2020].

[2] Learning Center. 2020. What Is Penetration Testing | Step-By-Step Process & Methods | Imperva. [online] Available at: <https://www.imperva.com/learn/application-security/penetration-testing/> [Accessed 21 March 2020].

[3] Jacobian.org. 2020. Don’t Include Social Engineering In Penetration Tests | Jacob Kaplan-Moss. [online] Available at: <https://jacobian.org/2017/jun/27/social-engineering-pentests/> [Accessed 21 March 2020].

2.
Is Social Engineering Ethical?
Andrew McKean posted Mar 20, 2020 12:00 AM
This page automatically marks posts as read as you scroll.Adjust automatic marking as read setting
I am 100% pro social engineering in modern penetration testing. As much as the service is used to test technical implementations such as firewalls and software security, a customer needs to test their staff on best security practices and education that these threats exist. Working for the DoD, we undergo annual education and training to best prepare the workforce against such threats and I believe that the public and private sector could benefit from the same, thereby safeguarding against intrusions, corporate espionage, and more. Kevin Mitnick explained that he could often get passwords and other pieces of sensitive information from companies by pretending to be someone else and just asking for it (Mitnick, 2017). This is why these practices need to be put in place.

Mitnick,K. (2007) The art of deception. Retrieved from https://pdfs.semanticscholar.org/9974/68975ffba55ada70b3ac3a13b5ae6853a80f.pdf