In recent years, people have become more familiar with the term "social engineering", the use of deception or impersonation to gain unauthorised access to resources from computer networks to buildings. Does this mean that there are fewer successful social engineering attacks? Probably not.
In fact, because computer security is becoming more sophisticated and more difficult to break (although this is still very possible) more and more people are resorting to social engineering techniques as a means of gaining access to an organisations' resources. Logical security is at a much greater risk of being compromised if physical security is weak and security awareness is low. Performing a social engineering test on an organisation gives a good indication of the effectiveness of current physical security controls and the staff's level of security awareness. But once you have decided to perform a social engineering test, where do you start? How do you actually conduct a social engineering test?
There are many different types of social engineer attacks, from mumble attacks (pretending to be speech impaired on the telephone) to ten attacks (using an attractive person to distract security) to reverse engineering (helping the target individual with a technical problem and then proceeding to elicit information from them). In my career, I mostly use social engineering for intrusion, gaining access to an organisations building. Therefore, although I will describe a selection of attacks, my talk will focus on gaining entry to buildings. However, gaining entry to buildings more often than not involves identifying and communicating with a target individual or individuals by telephone / email / fax / etc., so I will touch briefly on these areas also.