November NYC Testers Meetup
Details
Speaker: Dan Billing
https://a248.e.akamai.net/secure.meetupstatic.com/photos/event/3/2/8/2/600_455952930.jpeg
Topic: The Human Factor – Exploring Social Engineering
Security is and will continue to be a big problem for technologists, and of course testers. Systems and software are complex. They are designed and built by flawed individuals and teams. They may be insecure from the start, either through a lack of knowledge of how to test for security; or even through willful neglect and bad work.
However, it is the human factor of information security that is I feel the biggest concern. We are the biggest flaw in the system, not an unpatched server or poor UI validation. Have you ever held the door open at the office for someone you didn’t know? An IT engineer, a delivery worker, someone random in a suit? Then check out this example where a security consultant posed as an IT engineer for several days at a FTSE listed financial firm: http://www.computerworlduk.com/news/security/howamanusedsocialengineeringtotrickaftselistedfinancialfirm14706/
The Facebook “Dislike” button scams are a great example, where scammers preyed on gullible users, allowing their machines and browsers to be infected with malware and bots. Check out this video from security researcher Graham Cluely for more details: https://grahamcluley.com/2015/09/rightcuecomefacebookdislikebuttonscams/
And then there are the IT support scammers, calling up unsuspecting computer users trying to get them to expose their secrets or part with money. See Troy Hunt deal with one here: http://www.troyhunt.com/2012/02/scammingscammerscatchingviruscall.html
So, what does this mean for testers? Are we just interested in the technical aspects of security? I’d hope not, as that would be pretty boring. Humans are I believe the main flaw in the security of applications. I feel that testers should be mindful of that, when learning about our customers and about how to test our applications for security
This talk will explore how social engineering can be used to look at how easy it is to breach systems, through learning, observing, listening, manipulation and gamification! We’ll gather data from our environment, the people around us, files, images, sounds and other sources in order to gain access to our target!
Key Takeaways:
Understand how the human factor plays a major part in the security of your systems, applications and businessesExplore, use and understand a variety of social engineering techniques (legally)
Be able to reflect and learn from these issues to create testing ideas and scenarios
About Dan
Dan has been a tester for 16 years, working within a diverse range of development organizations, mostly in the south west of England. Formerly of NewVoiceMedia, he spent most of his time working on the security needs of the business. He is now working at Medidata, working with development teams to deliver great testing.
Dan’s love of testing drives me to become an active member of the testing community, helping to organize local tester meetups in the Bristol and Bath area. He is also a co facilitator with Weekend Testing Europe, and also organizes the South West Exploratory Workshop in Testing.