What would be the best way to teach and test employees on the topic of social engineering?
What topics would you include?
I work as a technical/customer support representative and have to be aware of Social Engineers on a daily basis. The thing is it's hard to explain why it's effective to a group of people that have not done Customer Support. So, here's what I'd have you do:
That's brief, but basically prepare customers by telling them that malicious people will pretend to be someone (or something, such as an authority or business partner) to gain information. And that they'll often use information that's freely available to make their story more convincing.
One good activity might be to have people play a game like "two lies, one truth." Ultimately, from my experience, it comes down to having a sound business policy that limits the damages of Social Engineering and prevents it.
Here are some ideas:
Hope this was helpful, Pesach