Re: Social Engineering Pentest

[Marco Ivaldi <raptor () mediaservice net>]

On Wed, 23 Apr 2008, Paul Melson wrote:

> The thing about SE - in my opinion, anyway - is that testing it in any 
> meaningful way requires that you have something to test against.

I wholeheartedly agree. The upcoming OSSTMM 3.0 [1] will thoroughly cover 
testing of the Human Security channel. Here's a short quote on this topic:

"This channel covers the involvement of people, primarily the operating 
personnel within the target scope or framework. While some services 
consider this simply as 'social engineering', the true compliance 
objective of security testing in this channel is personnel security 
awareness testing and gap measurement to the required security standard 
outlined in company policy, industry regulations, and/or regional 
legislation".

[1] http://www.isecom.org/osstmm/

Cheers,

--
Marco Ivaldi, OPST
Red Team Coordinator      Data Security Division
@ Mediaservice.net Srl    http://mediaservice.net/


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------