Social engineering testing methodology?

Question

Is there anything that could be used as a social engineering testing methodology from any sort of organisation (example: ISO, SANS, PCI DSS etc.)

Answer 1

I'm assuming by methodology you are looking for a social engineering framework. At a really high level, you'd follow the same sort of steps that you would with any other attack.

1. Pick a target
2. Study the target
3. Identify vulnerabilities
4. Create plan to exploit identified vulnerabilities
5. Execute the plan
6. Walk out unscathed

Much like a technical hack, there may be many hops from entry to final destination within a company. A remote attacker might need to know Linux, macOS, Windows, and a few scripting languages to make it through the barriers. A social engineer needs the ability to build trust and think on their feet as they iterate through their targets, especially in live environments (say pentesting a bank).

For some good, free, social engineering information I highly recommend digging through social-engineer.org. They not only run their own seminars but frequently work with DefCon to create the social engineering village. A good place to start is here:

https://www.social-engineer.org/framework/general-discussion/