Don't include social engineering in penetration tests - Jacob Kaplan-Moss

2 min read Original article ↗

I wrote this post in 2017, more than 8 years ago. It may be very out of date, partially or totally incorrect. I may even no longer agree with this, or might approach things differently if I wrote this post today. I rarely edit posts after writing them, but if I have there'll be a note at the bottom about what I changed and why. If something in this post is actively harmful or dangerous please get in touch and I'll fix it.

I’m not a fan of including social engineering – spearphishing, calls to support tickets, office visits – as part of penetration tests. These activities are risky, and often involve borderline and outright inappropriate behavior. Further, they tend not to produce useful results.

I encourage you to explicitly forbid social engineering attacks in your pentest scopes. Instead, try simulating the kinds of compromises that social engineering attacks lead to, with an emphasis on detection and response. This provides much more satisfying and useful outcomes, without the risks that allowing social engineering introduces.

I always welcome feedback on my writing — please feel free to get in touch if you have comments. I also try to help people with job searches, career advice, and other things; see some ways I can help. If you want to find out when I've posted new articles, subscribe for updates.

Published June 27th, 2017 .

Tags:

Next by date:

Five stories about the California Wildfires you probably missed

Previous by date:

Getting started with pytest

The Algorithm thinks these articles are similar: