Social engineering is one of the most well-known concepts in the world of information security. It refers to the ability to exploit people’s psychological characteristics to manipulate them into implementing hackers’ requests, for example, providing their identification or credit card details.
There are several common social engineering attack scenarios, and the main one is called Phishing. Employees receive seemingly innocent links or e-mail attachments and are lured to click them, thus providing hackers a way through which they can take over the computer or cellphone. Hackers’ sophistication has increased over the years, so employees unfamiliar with the subject may fall into the trap.
Several security products endeavor to address this problem, but employee training is crucial for dealing with these attacks. The best way to do this is by performing real-life drills, where a hacker first tries to trick the employee and then takes over the computer and proceeds by navigating the network.
This way, as an information security manager, you can examine employees’ vigilance and the protection systems that are supposed to respond should any employee is ensnared.
Who would be likely candidates for Phishing campaigns?
- Companies that are required, as part of the regulations, to perform employee awareness checks for cyber threats.
- Companies that fear hackers might manipulate employees’ unawareness to infiltrate and harm the organization and wish to address the issue. As is well known, most of the world’s cyberattacks stem from employees’ insufficient awareness.
What are the advantages?
- Ongoing examination of employee awareness and receipt of detailed information on the matter.
- Reviewing information security systems in such cases when an employee has been tricked into such Phishing schemes.
What are the highlights?
Madsec would let the customer choose between several different scenarios for conducting the test. The goal will be to get employees to enter the impersonating site and later take over the computer and gain access to the organization’s internal network.
There are several products in the field, but most are limited to examining the vigilance of employees. It would not suffice for your needs as the organization’s CISO; although you must guarantee employees’ attention, you must also inspect the protection systems to ensure a hacker who might have tricked an employee will not be able to cause real damage. That is why we offer a package that includes quarterly tests performed by a human hacker, employee awareness training and supporting leaflets.
