Re: Pen-Test and Social Engineering

[Louis Lerman <lblerman () gmail com>]

Yes, it can be. However, that would depend on what the client wants
(is it part of the RFP?). Of note, you should be careful when
reporting the results of such a test back to the client. In my
experience, when I would perform social engineering (as part of a
pen-test) I would only report statistics (e.g. % of user's "duped")
and not specific users that were "duped". Basically, the metrics that
could be used to interpret the effectiveness of the client's security
awareness.

My .02 cents.

Regards,

Louis

On 3 Feb 2006 14:03:18 -0000, burzella () inwind it <burzella () inwind it> wrote:
> Hi
> In yuor opinion, can a Social Engineering test be considered part of a Pen-Test?
>
> Thanks
>
> ------------------------------------------------------------------------------
> Audit your website security with Acunetix Web Vulnerability Scanner:
>
> Hackers are concentrating their efforts on attacking applications on your
> website. Up to 75% of cyber attacks are launched on shopping carts, forms,
> login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
> futile against web application hacking. Check your website for vulnerabilities
> to SQL injection, Cross site scripting and other web attacks before hackers do!
> Download Trial at:
>
> http://www.securityfocus.com/sponsor/pen-test_050831
> -------------------------------------------------------------------------------

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner:

Hackers are concentrating their efforts on attacking applications on your
website. Up to 75% of cyber attacks are launched on shopping carts, forms,
login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
futile against web application hacking. Check your website for vulnerabilities
to SQL injection, Cross site scripting and other web attacks before hackers do!
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------