Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Does anybody have advice on how to deal with social engineering in the context of writing up a penetration test report?
How do you assign a rating to social engineering? Obviously if you can convince a user with admin access to modify or delete a file, or to shut down a server, then it's a high risk. Is there a standard like the CVSS (https://nvd.nist.gov/CVSS-v2-Calculator) that should be used to rate it?
I'm not sure that I would rate it at all. Rating requires that you can define the limits and boundaries of the risk. The potential for every social engineering attack is extremely high.
If you successfully performed a social engineering attack, then I would simply list the event and the extent of the effect you had.
