Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What would be the best way to teach and test employees on the topic of social engineering?

What topics would you include?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

I work as a technical/customer support representative and have to be aware of Social Engineers on a daily basis. The thing is it's hard to explain why it's effective to a group of people that have not done Customer Support. So, here's what I'd have you do:

  • Have everyone that has worked a customer support job recall that experience (raise their hands and tell stories about pleasing the customer and how that eventually becomes the goal of the position; try to get them to express the mindset of not wanting to let a customer down and specifically if they've ever broken policy for a customer)
  • Then, transition to how people take advantage of that desire to help the customer (which is typically by pretending to be a person they're not)

That's brief, but basically prepare customers by telling them that malicious people will pretend to be someone (or something, such as an authority or business partner) to gain information. And that they'll often use information that's freely available to make their story more convincing.

One good activity might be to have people play a game like "two lies, one truth." Ultimately, from my experience, it comes down to having a sound business policy that limits the damages of Social Engineering and prevents it.

share|improve this answer

Here are some ideas:

  • Create a capture the flag game with a digital file (and whoever can social engineers it wins)
  • Show some examples in real life how people try to manipulate others to find out private information about them (for example: conditions they might have), this tends to help people understand better what social engineering is.

Hope this was helpful, Pesach

share|improve this answer
1  
Examples are a good idea. CTF is probably too hard for common users. Also CTF doesn't really work for people who don't care about it. Reading about some examples is way easier. –  Luc Aug 16 '12 at 0:35
    
Thx, for CTF you can do something simple like hand out 'secret' memos to different users and whoever can 'get' the most wins. obviously it might be hard to get people interested...but maybe there could be an insentive (like getting an hour off of work if you don't fall for the social engineering attacks?) –  pzirkind Aug 16 '12 at 16:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.