Black Hat 2012: Phishing and social engineering penetration testing

Black Hat 2012: Phishing and social engineering penetration testing

Date: Jul 26, 2012


Robert Westervelt, News Director

LAS VEGAS -- Some of the most high-profile data breaches started with a standard spear phishing attack, leaving some experts to advocate for more hardened technical defenses, but Rohyt Belani, CEO and co-founder of PhishMe Inc., believes user awareness training should be part of nearly every enterprise information security program.

"Spear phishing is going to be the attack vector of choice for a long time," Belani said. "The email protocol is broken. Human beings are as susceptible as they were 15 years ago."

More from Black Hat 2012

Get all the news, analysis, commentary and video interviews from Las Vegas on SearchSecurity.com's Black Hat 2012 special coverage page.

In an interview with SearchSecurity.com conducted at the 2012 Black Hat Briefings, Belani, who is also a founder of boutique security firms Intrepidus Group Inc. and Mandiant Corp., said sustained anti-social engineering training can help heighten the security awareness of end users and ultimately stop most end users from blindly clicking on links and opening email attachments. Belani’s new firm, PhishMe, provides Web-based security awareness training tailored to specific roles within an organization.

"Awareness should lead to behavior modification," Belani said. "We have statistics to prove that over time the end-user susceptibility to phishing attacks trends downward."

Belani discusses why he thinks training that features social engineering penetration testing can be effective, and explains why he isn't afraid to debate the naysayers. He also describes how organizations can properly introduce anti-social engineering training without creating a rift between the IT security team and other employees.

More on Security Awareness Training and Internal Threats-Information

  • canderson

    Researcher details findings on spoofing GPS, malicious insiders

    VIDEO - Roger Johnston of Argonne National Laboratory discusses the implications of spoofing GPS and ways to manage angry and potentially malicious insiders.

  • canderson

    Bruce Schneier: What is cyberwar?

    VIDEO - In this RSA Conference 2011 interview, Michael Mimoso, Editorial Director of the Security Media Group at TechTarget interviews Bruce Schneier, Chief Security Technology Officer of BT Group and tried to answer the question, "What is cyberwar?"

  • canderson

    Face-off: Information security awareness and when not to reveal information

    VIDEO - Can the security industry learn from the Transportation Security Administration? It may seem like an odd pairing, but both struggle with the challenges of protecting those in their care while maintaining usability and personal privacy.

  • exit interview

    Definition - An exit interview is a meeting between management representatives and someone who is leaving an organization. Businesses and other organizations such as educational institutions use exit interviews to gather useful feedback that can help guide future practices.

  • Attack security literacy with brute force

    Opinion - Forget the slogans. Reset your security awareness program with actionable information.

  • IT security strategy 2.0: Adjusting for a shifting infosec landscape

    Tip - Seismic shifts in the infosec landscape can no longer be ignored. Ernie Hayden explains how to update an IT security strategy to account for change.

  • Whistleblower policy: Preventing insider information leak incidents

    Tip - NSA-level incidents are rare, but they do happen. Learn how to prevent a whistleblower scenario and limit the risk of insider information leaks.

  • IT content and vendor engagement evaluation survey

    Survey - When IT professionals, such as you, have an IT project at their organization, there is a need to research multiple pieces of content from a variety of sources including vendors, third-parties and experts. This survey will allow TechTarget to identify the type of content that you prefer when conducting research related to your IT projects, and how you prefer to engage with vendors.
Back to top