RE: Penetration Testing - Human Factor

["Isaac Van Name" <ivanname () southerlandsleep com>]

With all due respect, isn't it necessary when playing statistics to analyze
all aspects of a given category?  It is inaccurate for you to say that
social engineering accounts for the majority of compromises if you have no
other data to compare the social engineering numbers to.  That's like saying
that everyone drives a Ford, based upon the surveys you conducted with
people that only drives Fords.

When trying to statistically summarize a subject like "hacking", you have to
address the technical aspect because, really, that is the biggest part.
Social engineering only gives you an opportunity to [possibly] get sensitive
information.  What you do with that sensitive information is the real
"hacking".

Isaac Van Name

-----Original Message-----
From: Marios A. Spinthiras [mailto:mario () netway com cy] 
Sent: Wednesday, August 23, 2006 1:40 AM
To: "arian dotevansanachronic.com"@securityfocus.com ();
pen-test () securityfocus com
Subject: Re: Penetration Testing - Human Factor

Arian how have you concluded that no evidence has been gathered? Indeed you 
have a point but thats only towards the technical aspect of it all.

Reading onwards to social engineering really shows the human vulnerability 
and the fact that we cant filter it all out , patch it. We can simply do 
nothing more than an advisory does...

I do not know how serious you consider social engineering to be but if you 
have not spent time with it please do so , I can offer you a lot of material

regarding this issue. Contact me personally if you would like the material.


Thanks,
Mario A. Spinthiras

----- Original Message ----- 
From: "Arian J. Evans" <arian.evans () anachronic com>
To: <pen-test () securityfocus com>
Sent: Tuesday, August 22, 2006 7:46 AM
Subject: RE: Penetration Testing - Human Factor


> I've seen nothing quantifiable.
>
> FWIW - every forensic engagement I have done of "true"
> hacking has had nothing to do with social engineering,
> and was entirely technical. Most appeared to be performed
> by SKiddies, but at least one was very subtle, and was
> performed by someone with real skill.
>
> I do see a biased sample though, since people do not
> generally come to me after they've been socially
> engineered, unless it's a girl I've dated.
>
> Your first statement does raise the question though
> about how does a skeptic conclude something before
> they gather evidence?
>
> Arian J. Evans
>
> > -----Original Message-----
> > From: Marios A. Spinthiras [mailto:mario () netway com cy]
> > Sent: Monday, August 21, 2006 1:20 AM
> > To: pen-test () securityfocus com
> > Subject: Penetration Testing - Human Factor
> >
> > As a thorough sceptic Id like to conclude in most cases of a
> > TRUE hacking
> > incident social engineering has been a factor of success for
> > the malicious
> > user attacking a system.
> >     For quite a while now I have been compiling methodology on the
> > assessment of the weak human security link which can be
> > exploited through
> > social engineering. Has anyone got any thoughts they would
> > like to share or
> > guidelines to the audit of the human factor when security is
> > concerned?
> >
> > Any information is much apreciated.
> >
> >
> > Many Thanks,
> > Mario A. Spinthiras
> >
> >
> > --------------------------------------------------------------
> > ----------
> > This List Sponsored by: Cenzic
> >
> > Need to secure your web apps?
> > Cenzic Hailstorm finds vulnerabilities fast.
> > Click the link to buy it, try it or download Hailstorm for FREE.
> > http://www.cenzic.com/products_services/download_hailstorm.php
> > --------------------------------------------------------------
> > ----------
>
>
> ------------------------------------------------------------------------
> This List Sponsored by: Cenzic
>
> Need to secure your web apps?
> Cenzic Hailstorm finds vulnerabilities fast.
> Click the link to buy it, try it or download Hailstorm for FREE.
> http://www.cenzic.com/products_services/download_hailstorm.php
> ------------------------------------------------------------------------


------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------




------------------------------------------------------------------------
This List Sponsored by: Cenzic

Need to secure your web apps?
Cenzic Hailstorm finds vulnerabilities fast.
Click the link to buy it, try it or download Hailstorm for FREE.
http://www.cenzic.com/products_services/download_hailstorm.php
------------------------------------------------------------------------