1
00:00:00,000 --> 00:00:04,920
12 years in information security experience, but he still considers himself a social

2
00:00:04,920 --> 00:00:10,360
engineer noob. I'm going to quote him on this. He enjoys all aspects of info security, but

3
00:00:10,360 --> 00:00:15,840
enjoys creeping on people and infrastructure using OSINT the most. And he's kind of, even

4
00:00:16,400 --> 00:00:20,580
though he's kind of creepy, he has been accused of having a man crush on the human hacker.

5
00:00:24,380 --> 00:00:29,800
Notice that's accused. This talk is not sponsored by his organization and if it was,

6
00:00:30,000 --> 00:00:33,620
he may be unemployed after giving it. So let's give him our attention. Fahey Owens. The

7
00:00:33,620 --> 00:00:37,220
theme is Beyond Phishing, Building and Sustaining a Corporate SE Program.

8
00:00:40,080 --> 00:00:46,360
Thank you, DEFCON SE Village. Thanks, Chris and Michelle, for this opportunity. I'm a

9
00:00:46,360 --> 00:00:50,780
cybersecurity manager at some financial services company. If you Google me, it'd be pretty

10
00:00:50,780 --> 00:00:55,360
easy to find. I've managed an ethical hacking team, vulnerability management team, and I

11
00:00:55,360 --> 00:00:58,380
have a social engineering team. And they're here today.

12
00:01:00,960 --> 00:01:07,140
And I, if you have any questions about this talk, e-mail me or you can follow me on Twitter.

13
00:01:07,420 --> 00:01:13,760
But I have an announcement to make. I'm a recovery for social, I've been addicted to social

14
00:01:13,760 --> 00:01:17,520
engineering for a long time and I'm in a recovery program for it. But I wasn't always

15
00:01:17,520 --> 00:01:21,740
addicted. In fact, I really didn't believe in social engineering about four or five years

16
00:01:21,740 --> 00:01:29,440
ago. I used to go to DEFCON over in Rio, see the social engineering village, come in, take a seat,

17
00:01:30,020 --> 00:01:36,380
take a look at people in the smelly box. I stayed there for a couple of minutes and I'd leave because I

18
00:01:36,380 --> 00:01:40,560
really didn't believe in it. And I managed an ethical hacking team at the time. And then things

19
00:01:40,560 --> 00:01:47,400
changed. You see, one day I came to work and my boss said, we want you to phish to people. And

20
00:01:47,400 --> 00:01:54,000
I'm like, why would I want to do that? You want me to do what? Phish to people.

21
00:01:54,600 --> 00:01:59,980
That's no fun. I was into Web applications, clients and things of that nature. I did want to phish

22
00:01:59,980 --> 00:02:05,520
not want to phish to people and no one on my team wanted to do that as well. So how hard could

23
00:02:05,520 --> 00:02:14,220
it be? You put a phish together, send an e-mail out and I did that and it was a disaster. We

24
00:02:14,220 --> 00:02:18,580
interrupt operations, the help desk was flooded with calls, the mail team was flooded with

25
00:02:18,580 --> 00:02:25,360
calls and the incident response team was flooded with calls. So I started thinking. I got a

26
00:02:25,360 --> 00:02:30,480
chance to redeem myself. And I had to find a way to answer this question of phishing

27
00:02:30,480 --> 00:02:36,540
organization. So I do what we all do when we have problems. We go to Google. And when I

28
00:02:36,540 --> 00:02:42,300
searched Google I ran upon the social-engineer.org website. Why? That's the same website of the

29
00:02:42,300 --> 00:02:47,860
team that manages the SE Village. So I went there and I listened to all the podcasts that were

30
00:02:47,860 --> 00:02:52,540
there. And I listened to Chris go through puberty in a podcast from number 1 to podcast 60.

31
00:02:55,720 --> 00:03:01,980
I'm just saying, Chris, your voice did get deeper as you moved on. And then I listened to

32
00:03:01,980 --> 00:03:09,360
podcast 44 because that's when a sultry Asian first started. I listened to that podcast about

33
00:03:09,360 --> 00:03:17,880
3 or 4 times. Yeah, I'm a little creepy. 3 or 4. And I read all the SE books and then I

34
00:03:17,880 --> 00:03:24,880
created a methodology. One of the things in this methodology that I created was to communicate.

35
00:03:25,660 --> 00:03:29,960
All the people who should do everything. Okay. And I did that and I had some success. Now,

36
00:03:30,060 --> 00:03:36,540
people still failed, but I did not interrupt the organization's operation at the time. You see

37
00:03:36,540 --> 00:03:40,140
when you run an ethical hacking, or you run vulnerability assessments, you only need to let

38
00:03:40,140 --> 00:03:45,040
the system owner know that you're going to perform an assessment. And they usually complain

39
00:03:45,040 --> 00:03:49,460
because you know they're going to end up with filings. But when you test a people and you

40
00:03:49,460 --> 00:03:55,340
let them know that it's coming they're like, oh OK. And I did that. For the people I was towering back

41
00:03:55,360 --> 00:04:00,060
But see, it comes with a cost. You see that chart at the bottom down there with the line

42
00:04:00,060 --> 00:04:06,540
going down? That's not the click rate. That's your popularity. You see? You will not be

43
00:04:06,540 --> 00:04:13,640
popular if you're phishing the entire organization continuously. So started thinking, is

44
00:04:13,640 --> 00:04:17,860
this really a career? Do really people get, I mean, do people really get paid for this

45
00:04:17,860 --> 00:04:23,100
besides Chris and Michelle? What about the other three deadly social engineering sins such

46
00:04:23,100 --> 00:04:28,440
as USP smishing and phishing? Well, did a Google search and it seems that social

47
00:04:28,440 --> 00:04:33,600
engineering is in good company. It was listed as one of the top six well-paying jobs of 2014.

48
00:04:34,860 --> 00:04:40,620
Right between bomb disposal diver and power line helicopter pilot. And it was still

49
00:04:40,620 --> 00:04:48,320
right behind the elusive ethical hacker. But where are jobs really today? You see, I did a

50
00:04:48,320 --> 00:04:53,080
search on the Google, do a little Google dorking, and you see indeed.com has a lot of

51
00:04:53,080 --> 00:05:00,840
jobs. That's 8,442 jobs. That's enough jobs for us all, right? Well, indeed, simply hired had

52
00:05:00,840 --> 00:05:09,000
150 and zip recruiter had one. You see, those aren't real jobs. Those are fake jobs. Kind of

53
00:05:09,000 --> 00:05:15,000
like fake news. In fact, what they do is they take any hit against social and list it as a job.

54
00:05:15,140 --> 00:05:20,740
So it could be social worker. It could be someone doing something with social media and it's

55
00:05:20,740 --> 00:05:23,060
listed as a social engineering job. But let's take a look at the other side of the spectrum. So,

56
00:05:23,080 --> 00:05:30,300
let's take a closer look at that zip recruiter job. So, this job, it has benefits, which, you

57
00:05:30,300 --> 00:05:34,980
know, we all need benefits. But if you look at the technical skills that you need, you need

58
00:05:34,980 --> 00:05:39,700
about five-plus years of social engineering planning, five-plus years of fishing and vishing

59
00:05:39,700 --> 00:05:44,940
exercise experience, five-plus years operating a simulated fishing platform, and five-plus

60
00:05:44,940 --> 00:05:51,640
years of training and awareness. Now, who in here would really qualify for that job? No, you

61
00:05:51,640 --> 00:05:53,060
wouldn't. They wouldn't. They wouldn't. They wouldn't. They wouldn't. They wouldn't. They wouldn't. They

62
00:05:53,060 --> 00:05:53,820
would all get their asses in the air. But technically that's one. So we Kevinankind, lamb'd

63
00:05:53,820 --> 00:05:59,300
working in Montgomery. We've worked. So, we're working, one. And you know what? That

64
00:05:59,300 --> 00:06:05,680
job is filled. That's probably who applied for it. The job was filled as of July 19th, and don't

65
00:06:05,680 --> 00:06:12,900
ask how I know. As was brought out earlier, we all know that the need for social engineering

66
00:06:12,900 --> 00:06:20,420
continues. Recently, in the IBM cybersecurity threat intelligence index, 95% of all data

67
00:06:20,420 --> 00:06:23,040
breaches involved some form of social engineering, even if an executive board hid it. So, in this

68
00:06:23,040 --> 00:06:26,680
In fact, it continues to impact us as people.

69
00:06:27,480 --> 00:06:32,420
The U.S. elections, good old John Podesta getting a phishing e-mail through the DNC.

70
00:06:32,580 --> 00:06:37,280
And recently they started to state that the French elections were impacted by social engineering as well.

71
00:06:38,500 --> 00:06:39,920
USBs haven't been out of the news.

72
00:06:40,220 --> 00:06:46,320
Just last year there was a study by the University of Illinois that stated about 95% of all students were plugged in USB drives.

73
00:06:46,700 --> 00:06:50,800
And IBM recently shipped USB drives to its customers with malware.

74
00:06:51,580 --> 00:06:55,400
And when it comes to phishing, we don't need to go any further than our own family.

75
00:06:55,520 --> 00:06:56,340
Yes, your grandparents.

76
00:06:56,800 --> 00:07:03,500
Go and ask your grandparents if they've received a phishing call, whether from the IRS or the scam that was going around,

77
00:07:03,640 --> 00:07:05,520
asking if, you know, can you hear me now?

78
00:07:05,720 --> 00:07:08,860
And they say yes, and they get signed up for some type of service.

79
00:07:08,920 --> 00:07:09,680
They get something in the mail.

80
00:07:09,980 --> 00:07:13,160
So the need is still there, whether it's for corporate America.

81
00:07:13,320 --> 00:07:16,920
The need for training is still there, whether it's for corporate America or whether it's for us.

82
00:07:18,240 --> 00:07:19,740
But let's take a look at the millennials.

83
00:07:20,980 --> 00:07:25,940
This is the largest group as of 2015 that's employed in your corporation.

84
00:07:26,280 --> 00:07:28,240
They make up over half of all new hires.

85
00:07:29,380 --> 00:07:33,780
This group is the most technologically advanced group ever.

86
00:07:34,080 --> 00:07:38,260
They literally grew up with the Internet, and they literally grew up with phones in their hands.

87
00:07:39,020 --> 00:07:41,440
This group prefers texting over phone calls.

88
00:07:42,160 --> 00:07:46,720
And, in fact, most of them, over 68%, admit to texting a lot.

89
00:07:47,720 --> 00:07:49,440
Email for them is secondary.

90
00:07:50,040 --> 00:07:50,560
But.

91
00:07:50,800 --> 00:07:53,920
Even with this, overall email use continues to rise.

92
00:07:54,560 --> 00:07:59,920
So that goes to show you that phishing and smishing will be a vector for this generation that's coming in.

93
00:08:01,300 --> 00:08:05,880
I had a chance to do my own survey against millennials, and I had some pretty interesting results.

94
00:08:07,260 --> 00:08:10,800
Fifty-five percent claimed to know about social engineering, so that's pretty good.

95
00:08:10,840 --> 00:08:14,360
You can tell by the size of the audience here.

96
00:08:15,160 --> 00:08:20,780
But ninety-six percent claimed to have been phished or received an unsolicited email.

97
00:08:20,780 --> 00:08:22,740
Or received a phone call or a text message within the last six months.

98
00:08:23,720 --> 00:08:25,900
Eighty-two percent never heard of smishing.

99
00:08:26,680 --> 00:08:28,980
Ninety percent never heard of phishing.

100
00:08:29,400 --> 00:08:36,660
And only 79% would say that they would not plug in a file on a USB drive or a mobile device.

101
00:08:37,420 --> 00:08:43,160
But this arrogant group, 50% of them claim they know how to handle all of the above, even though they never heard of two of them.

102
00:08:45,940 --> 00:08:49,200
Doing research on some of the data that I have access to,

103
00:08:49,320 --> 00:08:50,640
I see a bunch of them still.

104
00:08:50,780 --> 00:08:51,880
They still fail phishing attempts.

105
00:08:52,320 --> 00:08:55,880
In fact, they fail more than us so-called old folks.

106
00:08:56,640 --> 00:08:59,740
Some more research shows that they have poor hygiene as far as security.

107
00:09:00,320 --> 00:09:04,040
There was a recent study that showed that of people who reused their emails,

108
00:09:04,650 --> 00:09:08,600
of the total population that reused their passwords,

109
00:09:09,120 --> 00:09:12,540
of the total populace, 92% were millennials.

110
00:09:13,280 --> 00:09:18,860
In fact, another study showed that even though they're more comfortable using technology than their elders,

111
00:09:19,510 --> 00:09:20,760
that security is still there.

112
00:09:20,780 --> 00:09:22,260
It doesn't flow down into the organization.

113
00:09:24,680 --> 00:09:26,800
So, this is your organization, right?

114
00:09:27,020 --> 00:09:30,580
So how do you move beyond phishing to move to the next three deadly sins?

115
00:09:30,940 --> 00:09:34,120
Smishing, USB access, malicious media, or phishing?

116
00:09:34,800 --> 00:09:37,960
In my experience, I've had to deal with what I call the big three.

117
00:09:39,340 --> 00:09:42,040
HR, legal, and people in the politics.

118
00:09:43,120 --> 00:09:44,300
So, let's start with HR.

119
00:09:44,540 --> 00:09:45,340
We know their job.

120
00:09:45,500 --> 00:09:46,940
Their role is to help protect the people.

121
00:09:47,300 --> 00:09:48,620
They do payroll sometimes.

122
00:09:48,840 --> 00:09:49,380
They do benefits.

123
00:09:49,380 --> 00:09:52,720
And they hire people, and they probably regret hiring me.

124
00:09:54,000 --> 00:09:56,420
But, you want to make sure that you're friends with this group.

125
00:09:56,700 --> 00:09:58,980
You want to make sure that you build a strong relationship with them,

126
00:09:59,020 --> 00:10:00,760
especially if you look to move past phishing.

127
00:10:01,040 --> 00:10:07,760
You don't want to do anything hypothetical like sending a payroll phishing email at the end of the month,

128
00:10:07,820 --> 00:10:11,740
which impacted payroll and your paycheck was messed up a little bit.

129
00:10:13,260 --> 00:10:15,880
And you also want to make sure that you're friends with legal.

130
00:10:16,300 --> 00:10:18,020
They do the thing, you know, they do the right thing.

131
00:10:18,060 --> 00:10:18,980
They do all their lawyer stuff.

132
00:10:18,980 --> 00:10:20,140
I don't know much about law.

133
00:10:20,320 --> 00:10:26,720
But you want to make sure that you understand what the operational impact of sending a phishing email or moving beyond that is.

134
00:10:27,600 --> 00:10:34,380
For instance, on a Friday night, you don't want to send any legal related document because they are obligated to stay there.

135
00:10:34,500 --> 00:10:38,880
And some poor clerk may be there responding to a phishing email unknowingly.

136
00:10:39,520 --> 00:10:40,960
And not that any of this has happened.

137
00:10:42,660 --> 00:10:45,140
Now, let's move on to the last of the big three.

138
00:10:45,280 --> 00:10:47,560
Your company's politics and their ego.

139
00:10:48,120 --> 00:10:48,660
You see.

140
00:10:48,660 --> 00:10:52,120
I have listed Dr. Paul Ekman's seven emotions.

141
00:10:52,440 --> 00:10:57,200
There's anger, disgust, fear, joy, sadness, surprise, and contempt.

142
00:10:57,720 --> 00:10:59,420
Now, you think about the size of your organization.

143
00:10:59,780 --> 00:11:02,300
You think about all of this is always constantly going on.

144
00:11:02,340 --> 00:11:03,640
All these emotions are changing.

145
00:11:03,700 --> 00:11:06,280
All these triggers are happening at any moment of the day.

146
00:11:06,480 --> 00:11:11,980
And when you start to want to move past phishing and they get wind of it, you know, it may be a problem.

147
00:11:12,320 --> 00:11:17,080
I can tell you that I've dealt with anger, disgust, and contempt the most out of all of these seven.

148
00:11:17,080 --> 00:11:22,140
And as you look to move forward with this, you may deal with these as well.

149
00:11:24,120 --> 00:11:25,400
So how do you tame that?

150
00:11:25,700 --> 00:11:27,140
How do you deal with the big three?

151
00:11:27,360 --> 00:11:29,200
First off, you've got to do your homework.

152
00:11:29,600 --> 00:11:30,840
You've got to do the boring stuff.

153
00:11:31,340 --> 00:11:34,900
You've got to go look at your organizational policies and standards.

154
00:11:35,300 --> 00:11:41,480
Because that's the only way that you'll be able to make sure that your programs line up with what the organization says.

155
00:11:41,800 --> 00:11:45,020
How are you supposed to handle a suspicious phone call?

156
00:11:45,140 --> 00:11:47,060
How are you supposed to handle an unsolicited call?

157
00:11:47,060 --> 00:11:48,620
How are you supposed to handle an unsolicited text message on your phone?

158
00:11:49,420 --> 00:11:55,180
Also, you want to add more meat by looking at the threat by using real-time threat intelligence.

159
00:11:55,460 --> 00:12:02,460
You want to look at any threats that happen against your organization and any threats that happen against your industry or your stack.

160
00:12:03,100 --> 00:12:12,920
And also, you want to read any breach reports you can because that will help give you food as you move forward to introducing these new programs or new steps in your program.

161
00:12:13,620 --> 00:12:17,000
And most importantly, you want to create a methodology.

162
00:12:17,860 --> 00:12:23,000
You see, how are you going to handle USB drives across multiple areas?

163
00:12:24,520 --> 00:12:25,900
How are you going to prepare them?

164
00:12:26,000 --> 00:12:27,380
And how are you going to destroy them?

165
00:12:27,460 --> 00:12:33,760
Because there's no way that you send them, even if a USB drive was brought back, there's no way you should send that back out in the field.

166
00:12:34,320 --> 00:12:35,420
The other thing was smishing.

167
00:12:35,780 --> 00:12:44,660
As we look into BYOD devices, you run into legal issues about leaving artifacts on there if you decide to drop payload.

168
00:12:44,940 --> 00:12:47,040
And also the information that you pull back on those devices.

169
00:12:47,060 --> 00:12:49,120
And then, phishing.

170
00:12:49,320 --> 00:12:50,240
Pre-texting.

171
00:12:50,280 --> 00:12:51,820
This is new language for them.

172
00:12:51,880 --> 00:12:54,440
They're not going to understand what a pre-text is, so you're going to have to explain it.

173
00:12:54,520 --> 00:12:59,080
And also, you're going to have to explain what the target should be and what the success rate is.

174
00:12:59,200 --> 00:13:02,080
If someone receives a phishing phone call, what are they supposed to do?

175
00:13:02,680 --> 00:13:05,700
You want to review your local privacy laws, just like they've done here in Nevada.

176
00:13:05,960 --> 00:13:09,320
And you also want to explain how often you're going to do your assessments.

177
00:13:09,680 --> 00:13:12,860
And once again, you've got to communicate to the big three.

178
00:13:15,400 --> 00:13:17,040
And you also want to sustain that.

179
00:13:17,720 --> 00:13:19,600
You're going to want to do data analysis.

180
00:13:19,980 --> 00:13:24,440
You want to get all the data that you can from phishing and smishing results.

181
00:13:24,820 --> 00:13:28,620
You want information like their age and their gender and their language and department of job roles.

182
00:13:28,820 --> 00:13:34,340
Getting this information will help you understand what the attack surface looks like in your organization when it comes to people.

183
00:13:34,580 --> 00:13:39,500
You'll be able to work with training and awareness and have them target their training towards certain parts of the organization.

184
00:13:40,040 --> 00:13:47,040
The other data that you receive from fails from smishing and from the other data that you receive from smishing

185
00:13:47,060 --> 00:13:50,660
and from phishing includes system and device patch information.

186
00:13:51,220 --> 00:13:56,720
You can use that to share with the vulnerability management team to help understand gaps that are in your environment for patching.

187
00:13:57,080 --> 00:14:00,700
And another thing you want to do, get real incidents.

188
00:14:01,260 --> 00:14:02,460
Work with the IR team.

189
00:14:02,820 --> 00:14:09,480
Find out the people who get real phishing emails and check to see what the test results are for them in those phishing emails.

190
00:14:09,680 --> 00:14:14,200
And that way you can also get that to training and awareness and use that to help get specialized training.

191
00:14:14,420 --> 00:14:17,040
And again, continue that line of communication.

192
00:14:17,680 --> 00:14:19,140
And continue that moving on.

193
00:14:19,600 --> 00:14:23,380
And overall you want that to help improve your overall program.

194
00:14:24,360 --> 00:14:25,840
And also you want to get creative.

195
00:14:26,280 --> 00:14:34,560
You know, the organization gets tired or gets used to seeing just your normal fluorescent USB drives with something written across it.

196
00:14:34,720 --> 00:14:36,260
You know, you got a bunch of millennials in there.

197
00:14:36,300 --> 00:14:37,280
They have short attention spans.

198
00:14:37,500 --> 00:14:42,100
So do things like, you know, comic books or comic characters, things of that nature.

199
00:14:42,240 --> 00:14:44,900
And in your organization, people may be starving for hardware.

200
00:14:45,180 --> 00:14:45,880
Use mice.

201
00:14:45,880 --> 00:14:48,460
And I'm not saying you have to program the USB drives.

202
00:14:48,680 --> 00:14:51,220
But just use generic USB drives next to a mouse.

203
00:14:51,380 --> 00:14:53,880
You will be surprised what people plug in.

204
00:14:54,200 --> 00:15:01,040
Even if your organizational policy states that they're not supposed to plug in USB drives, they still plug in a bunch of other things.

205
00:15:01,300 --> 00:15:03,800
And if you don't believe me, get access to your scene logs.

206
00:15:05,160 --> 00:15:07,340
Also, don't try to boil the ocean.

207
00:15:07,640 --> 00:15:10,100
Get access to open source tools.

208
00:15:10,360 --> 00:15:11,860
Use the social engineering tool kit.

209
00:15:12,080 --> 00:15:13,160
Use Kingfisher.

210
00:15:13,320 --> 00:15:15,860
And just recently we started looking at the space.

211
00:15:15,880 --> 00:15:19,720
The smart phone pen test framework from George Weidman.

212
00:15:22,040 --> 00:15:26,820
Other factors that may impact you as you want to move beyond phishing, the size of your organization.

213
00:15:27,280 --> 00:15:30,340
This may not work if it's about 100 people inside your organization.

214
00:15:30,760 --> 00:15:30,880
Okay?

215
00:15:31,420 --> 00:15:34,980
And you also want to make sure you get your executive and leadership buy-in.

216
00:15:35,260 --> 00:15:40,780
I'm fortunate or my organization is fortunate to have that, to have our leaders believe in all four aspects of social engineering.

217
00:15:41,080 --> 00:15:41,480
Okay?

218
00:15:41,560 --> 00:15:42,440
And your budget.

219
00:15:43,120 --> 00:15:44,780
Again, when it comes to USB drives.

220
00:15:44,780 --> 00:15:47,480
You know, not everybody can afford to get 200 rubber duckies.

221
00:15:47,520 --> 00:15:48,460
So you have to get creative.

222
00:15:48,680 --> 00:15:50,760
You may have to write batch files or scripts on those drives.

223
00:15:51,480 --> 00:15:53,580
And last but not least, your company culture.

224
00:15:53,980 --> 00:15:55,480
You know, that plays a big part.

225
00:15:55,640 --> 00:16:02,600
Because, again, as you go against the third leg of that big three, you know, that can be quite challenging to get past.

226
00:16:03,480 --> 00:16:07,880
And if you can't get through any of them, don't try to boil the ocean, as the last speaker said.

227
00:16:08,140 --> 00:16:09,000
Choose just one.

228
00:16:09,500 --> 00:16:10,720
Maybe it's just phishing.

229
00:16:10,860 --> 00:16:11,920
Or maybe it's just phishing.

230
00:16:11,920 --> 00:16:17,500
Depending on if your organization has a large customer service base or a large mobile workforce.

231
00:16:19,320 --> 00:16:23,860
So the goal is to reduce the impact from all social engineering attacks.

232
00:16:24,280 --> 00:16:26,400
Most organizations are doing phishing today.

233
00:16:26,700 --> 00:16:30,340
You know, one of the ways, but we want to push past phishing.

234
00:16:30,660 --> 00:16:33,100
And one of the ways to do that is create a methodology.

235
00:16:33,380 --> 00:16:38,080
You know, we have to communicate with other parts of the organization as we move past phishing.

236
00:16:38,320 --> 00:16:40,360
And we also want to do continuous testing.

237
00:16:40,360 --> 00:16:42,160
Frequency depends upon your culture.

238
00:16:42,540 --> 00:16:49,120
And also you want to take all your findings and make sure that you can get that tied into your social engineering awareness training programs.

239
00:16:50,700 --> 00:16:59,540
So in conclusion, if you're phishing and you're trying to move past that and get to the other four, don't give up.

240
00:17:00,040 --> 00:17:02,840
It's taken me about four years to get to this point.

241
00:17:03,920 --> 00:17:09,580
And also, there's a real need for more social engineering jobs, not just fake ones out there on the web.

242
00:17:09,580 --> 00:17:16,100
So hopefully in the future, one day when you do a job search for social engineer, you'll find about 200 plus jobs.

243
00:17:16,500 --> 00:17:17,180
Thanks.

244
00:17:28,200 --> 00:17:29,400
Any questions?

245
00:17:33,360 --> 00:17:39,560
What's your opinion of services such as Wombat or other platforms that are free-for-all?

246
00:17:41,820 --> 00:17:48,920
I think that SaaS services play a part, especially when you do a large-scale phishing.

247
00:17:49,460 --> 00:17:53,980
But each tool has its particular place.

248
00:17:54,120 --> 00:17:58,420
But I still prefer to use open source tools for certain techniques and attacks.

249
00:18:00,280 --> 00:18:01,160
There's one in the back.

250
00:18:02,660 --> 00:18:09,300
Six to nine months ago, the Department of Homeland Security and the FBI said that they considered phishing to be more dangerous than hacking.

251
00:18:09,300 --> 00:18:09,560
That's right.

252
00:18:09,580 --> 00:18:10,060
I think that's the whole point.

253
00:18:10,380 --> 00:18:11,100
Remember that statement?

254
00:18:11,360 --> 00:18:12,020
Yes, I do.

255
00:18:12,220 --> 00:18:15,520
They actually said that that was more deadly, more dangerous, and more of a threat.

256
00:18:16,240 --> 00:18:17,480
What does that say?

257
00:18:17,860 --> 00:18:20,720
That's saying that it is a threat, right?

258
00:18:20,860 --> 00:18:23,320
I mean, phishing, you know, everyone is phishing right now.

259
00:18:23,440 --> 00:18:25,160
That still continues to be a threat.

260
00:18:25,760 --> 00:18:29,840
In fact, I think the IRS has a training program now that you can take for phishing.

261
00:18:30,320 --> 00:18:32,180
But you can't ignore the other threats.

262
00:18:32,320 --> 00:18:34,760
You know, we still have phishing attacks and smishing attacks that happen.

263
00:18:34,860 --> 00:18:38,180
And especially not only against us personally but against us in corporations.

264
00:18:38,180 --> 00:18:41,340
But, yes, phishing will still be number one for a while.

265
00:18:43,620 --> 00:18:46,400
What about other channels such as Slack?

266
00:18:47,380 --> 00:18:48,220
Such as Slack?

267
00:18:48,480 --> 00:18:48,600
Yeah.

268
00:18:51,140 --> 00:18:52,300
I'll have to think about that one.

269
00:18:52,560 --> 00:18:57,260
So the question is what about other channels such as Slack?

270
00:18:57,460 --> 00:18:57,640
Yeah.

271
00:18:57,680 --> 00:19:06,600
So my organization does a lot of security testing myself and my team because of the nature of the things that we deal with.

272
00:19:06,600 --> 00:19:15,240
But one of the ones I haven't seen them utilize yet is Slack, which would be a very good vector given the rate at which we are hiring people and the people .

273
00:19:15,920 --> 00:19:18,580
So validation against that would be difficult.

274
00:19:18,800 --> 00:19:28,260
So somebody could come in and request something and then your team member may respond to that and provide access without doing proper validation.

275
00:19:28,700 --> 00:19:30,460
And it's not a method that we normally see.

276
00:19:30,720 --> 00:19:33,560
That is a good attack vector.

277
00:19:33,700 --> 00:19:35,080
And I'll have to do some more research on that.

278
00:19:35,180 --> 00:19:35,940
But that's good.

279
00:19:36,600 --> 00:19:38,900
So Slack and other methods of communication.

280
00:19:39,440 --> 00:19:39,600
Yeah.

281
00:19:41,120 --> 00:19:42,040
Any more questions?

282
00:19:43,940 --> 00:19:45,000
Any more questions?

283
00:19:46,080 --> 00:19:46,740
I'm sorry.

284
00:19:46,900 --> 00:19:47,440
Hey, Howie.

285
00:19:49,000 --> 00:19:54,260
What do you think is the least amount of coverage that people don't know about phishing?

286
00:19:55,160 --> 00:19:56,600
Oh, that's a good question.

287
00:19:56,760 --> 00:19:59,980
Which of the four have the least amount of coverage?

288
00:20:00,180 --> 00:20:04,240
I would say most people know about phishing.

289
00:20:04,240 --> 00:20:06,840
And they know about vishing.

290
00:20:07,020 --> 00:20:08,680
They know of it or they've experienced it.

291
00:20:09,180 --> 00:20:11,780
And you hear more people start talking about USB attacks.

292
00:20:12,040 --> 00:20:14,200
And the last would be smishing.

293
00:20:14,380 --> 00:20:21,240
People, they don't know what a smish is or basically a spear phish against a phone.

294
00:20:21,380 --> 00:20:23,300
And they don't know how to respond to that.

295
00:20:24,320 --> 00:20:25,060
No, thank you.

296
00:20:26,720 --> 00:20:27,160
.

297
00:20:28,160 --> 00:20:28,640
.

298
00:20:37,800 --> 00:20:43,600
So how do we handle the limitations of the team size and getting used to the voice?

299
00:20:44,280 --> 00:20:46,380
I'm in a large organization.

300
00:20:46,660 --> 00:20:48,480
So I do a lot of training awareness.

301
00:20:48,580 --> 00:20:51,240
So I don't do any of the calls.

302
00:20:51,560 --> 00:20:55,040
But our team, they're pretty good.

303
00:20:57,840 --> 00:20:59,240
.

304
00:21:01,500 --> 00:21:02,900
.

305
00:21:09,920 --> 00:21:11,320
.

306
00:21:13,560 --> 00:21:14,960
.

307
00:21:14,960 --> 00:21:16,620
.

308
00:21:16,620 --> 00:21:16,740
.

309
00:21:18,060 --> 00:21:18,620
.

310
00:21:19,480 --> 00:21:20,040
.

311
00:21:20,040 --> 00:21:27,520
So the question is have we ever brought in a third party or had a third-party assessment?

312
00:21:27,720 --> 00:21:30,520
People fail or are victimized in their feelings?

313
00:21:31,360 --> 00:21:31,920
Yes.

314
00:21:32,160 --> 00:21:46,640
So that's one of the downsides of kind of doing this, is that you hear a lot of complaints and we have mailboxes or social networking groups set up for people to express themselves.

315
00:21:46,720 --> 00:21:52,500
themselves. And in fact on one of the slides I was going to mention that I think we've

316
00:21:52,500 --> 00:21:56,900
received maybe less than five to ten people who have actually sent emails saying thank you.

317
00:21:57,520 --> 00:22:03,360
Most of them are, you know, why are you doing this? I don't have time for it. This is my

318
00:22:03,360 --> 00:22:07,880
day. This is my job. I don't care. Things of that nature. So one of the things that we do

319
00:22:07,880 --> 00:22:14,440
is I try to give real attacks. I try to give incidents that come across from incident

320
00:22:14,440 --> 00:22:19,740
response and say here, so you don't care about, you know, clicking an email. This is a real

321
00:22:19,740 --> 00:22:24,800
attack that came against this person and the impact would have been X. And that's one thing

322
00:22:24,800 --> 00:22:31,860
that I find helps out a lot. Real attacks. Using canned examples from, you know, a fast tool

323
00:22:32,400 --> 00:22:37,460
doesn't work. But when you show real examples of a CEO who was attacked or just a phishing

324
00:22:37,460 --> 00:22:43,520
attack against someone within the organization, that turns the lights on. Question?

325
00:22:43,520 --> 00:22:49,520
Yeah, I'm kind of curious. These people that are responding backward, negatively, what kind of impact

326
00:22:49,520 --> 00:22:52,100
does it have on them? Are they just wasting their time? Are they off the fire?

327
00:22:53,080 --> 00:22:59,260
No. So, you know, I believe that people should have the ability to express themselves.

328
00:22:59,880 --> 00:23:03,780
But at the same time, you know, they need to understand why we're doing this. So again,

329
00:23:03,900 --> 00:23:10,180
communicating. I like real world information. I like using real world attacks to show them the need.

330
00:23:10,360 --> 00:23:13,460
You misunderstand. What I mean though is people that are upset, are they

331
00:23:13,520 --> 00:23:18,300
upset because of any impact on them other than loss of time because of your attack? Or were they

332
00:23:18,300 --> 00:23:21,920
penalized at all because they didn't handle it very well? I think it's a little bit of both.

333
00:23:23,640 --> 00:23:30,160
So when you read some of the reviews that we received back, it is some point to training.

334
00:23:30,320 --> 00:23:34,200
You know, I haven't had enough training. Or we haven't had, you know, X amount of training. Or it

335
00:23:34,200 --> 00:23:40,500
may be I was in the middle of something and I clicked a link because X. You know, and this was

336
00:23:40,500 --> 00:23:43,140
unfair because my day is busy. So it's a little bit of both.

337
00:23:47,420 --> 00:23:54,300
Good one. So return of investment, when you have a, when you use open source tools,

338
00:23:54,460 --> 00:24:01,840
that keeps down the cost, right? Trying to disperse a boatload of USB drives on a frequent

339
00:24:01,840 --> 00:24:08,140
basis. I can't say how many. You use cheap drives. You know, like I couldn't afford to use

340
00:24:08,140 --> 00:24:13,420
rubber duckies all the time, right? Because of cost. But the return of investment on the overall

341
00:24:13,520 --> 00:24:20,340
program itself. So for me, I really don't have to worry about the click rate going down. I'm not

342
00:24:20,340 --> 00:24:24,960
judged by that. That's another department, which is great. But on the other hand, you want to

343
00:24:25,340 --> 00:24:30,240
define what your success factor is. And that success factor is really defined by what a user

344
00:24:30,240 --> 00:24:35,500
does when they receive a suspicious e-mail or call. Did they follow the right thing? Did they do

345
00:24:35,500 --> 00:24:43,240
the right thing? Which is either, which is reported. You mentioned earlier about real world attacking

346
00:24:43,520 --> 00:24:47,800
and trying to model what actually happened. But you also said about how it might have been

347
00:24:47,800 --> 00:24:53,160
wondrous to interrupt operations. How do you sort of balance the two or three real world attacks

348
00:24:53,160 --> 00:24:58,280
while not simultaneously affecting operations in a negative way? So when you look at real

349
00:24:58,280 --> 00:25:07,420
world attacks, I can use, I can use this. So the, the attack against the DNC, I believe, had a

350
00:25:07,420 --> 00:25:13,500
spear phishing e-mail that was, that was targeted toward cyber security, actually. So the

351
00:25:13,520 --> 00:25:17,660
attack against cyber security, right? When you, when you look at attacks like that, and you

352
00:25:17,660 --> 00:25:21,560
look at the operation, you look at the operational impact. So you're, generally in most

353
00:25:21,560 --> 00:25:27,600
organizations, finance, HR, payroll, those are, you know, those are pretty much your, your

354
00:25:28,580 --> 00:25:31,900
high, high value organizations. And of course you have your executive levels and things of that

355
00:25:31,900 --> 00:25:39,160
nature. So when we go after, when we target those groups, we want to communicate with someone

356
00:25:39,160 --> 00:25:43,320
that's in there, in that area. You want to have someone that's in there that champions you and

357
00:25:43,520 --> 00:25:48,720
understands what's going on. So when you do send that off, so that there's not, you want to

358
00:25:48,720 --> 00:25:52,660
communicate, basically. So there's not mass panic when one of those types of scenarios go off.

359
00:25:55,660 --> 00:26:02,320
Do you, and this kind of goes back to another gentleman's question. When people fail tests,

360
00:26:02,640 --> 00:26:09,680
people who get up there, if they fail on a continuous basis, is there a plan that you guys have in

361
00:26:09,680 --> 00:26:13,500
place within their own management structure to increase the number of people who fail?

362
00:26:13,520 --> 00:26:20,460
How do you address their, uh, knowledge and, uh, feeling responsibility to this?

363
00:26:20,480 --> 00:26:22,020
When they say, I just don't care.

364
00:26:23,380 --> 00:26:28,420
So, okay. So, uh, I'm going to shorten it. How do you, how do you address someone that doesn't care?

365
00:26:28,700 --> 00:26:32,860
Okay. That's a good question because it came up, uh, last week in a conversation that I had.

366
00:26:32,980 --> 00:26:38,460
How do you know that someone doesn't care? You know, how do you know if someone fails 12 times a year,

367
00:26:38,580 --> 00:26:42,920
okay, and they just consistently fail, how do you know that that's egregious? Okay.

368
00:26:42,920 --> 00:26:47,680
So one of the, one of the, the thoughts that I had was you want people to do the right thing no matter

369
00:26:47,680 --> 00:26:52,120
if they fail or not. You want them to report. Is this person doing the right thing or are they just,

370
00:26:52,760 --> 00:26:56,900
you know, failing on purpose? And I think that's, that's probably the only thing that I can

371
00:26:56,900 --> 00:27:02,800
really think of. Are they following the proper, the proper, uh, process for a, a fail within the

372
00:27:02,800 --> 00:27:03,140
organization?

373
00:27:04,060 --> 00:27:09,240
What if they are in a position of power and they can be used to fail? How do you address that?

374
00:27:09,260 --> 00:27:10,080
So, um.

375
00:27:10,600 --> 00:27:11,000
.

376
00:27:11,000 --> 00:27:14,620
If they're, if they're in power and they continues to, continues to fail.

377
00:27:16,320 --> 00:27:19,100
That's, that's still on. Um, camera's still on, right?

378
00:27:19,520 --> 00:27:20,000
.

379
00:27:21,280 --> 00:27:25,720
There is another group that's responsible for training executives at, at my organization.

380
00:27:26,740 --> 00:27:27,220
.

381
00:27:29,060 --> 00:27:31,260
I told you I might be unemployed after this. Yeah.

382
00:27:31,400 --> 00:27:31,840
.

383
00:27:32,420 --> 00:27:39,020
So in the, the slides you had mentioned, uh, uh, an open source framework that wasn't

384
00:27:39,020 --> 00:27:40,180
on the slide.

385
00:27:41,000 --> 00:27:41,400
.

386
00:27:41,400 --> 00:27:46,340
Um, there were, there were, uh, three tools I had listed. One was the, uh, Wisset

387
00:27:46,340 --> 00:27:52,360
social engineering toolkit. The other was King Fisher. And the, the last one was the smart

388
00:27:52,360 --> 00:27:55,040
phone framework by Georgia Weidman.

389
00:27:55,260 --> 00:27:55,600
.

390
00:27:57,340 --> 00:28:00,320
No problem. I got like two minutes. Question?

391
00:28:01,080 --> 00:28:01,600
.

392
00:28:01,600 --> 00:28:01,700
.

393
00:28:01,700 --> 00:28:01,800
.

394
00:28:01,800 --> 00:28:02,020
.

395
00:28:03,700 --> 00:28:05,100
.

396
00:28:09,560 --> 00:28:10,960
.

397
00:28:10,960 --> 00:28:11,020
.

398
00:28:11,020 --> 00:28:11,200
.

399
00:28:11,200 --> 00:28:11,440
.

400
00:28:11,440 --> 00:28:11,480
.

401
00:28:11,480 --> 00:28:13,960
.

402
00:28:13,960 --> 00:28:14,060
.

403
00:28:14,060 --> 00:28:16,360
.

404
00:28:30,560 --> 00:28:31,960
.

405
00:28:31,960 --> 00:28:33,620
.

406
00:28:33,620 --> 00:28:35,260
.

407
00:28:35,260 --> 00:28:35,540
.

408
00:28:35,540 --> 00:28:36,140
.

409
00:28:36,140 --> 00:28:36,340
.

410
00:28:36,340 --> 00:28:37,760
.

411
00:28:37,760 --> 00:28:37,800
.

412
00:28:37,800 --> 00:28:38,500
.

413
00:28:38,500 --> 00:28:38,780
.

414
00:28:38,780 --> 00:28:39,580
.

415
00:28:39,580 --> 00:28:39,680
.

416
00:28:39,680 --> 00:28:39,700
.

417
00:28:39,700 --> 00:28:39,840
.

418
00:28:42,620 --> 00:28:43,320
.

419
00:28:46,540 --> 00:28:47,240
.

420
00:28:47,240 --> 00:28:47,260
.

421
00:28:47,260 --> 00:28:48,180
.

422
00:28:48,180 --> 00:28:48,280
.

423
00:28:48,280 --> 00:28:48,840
.

424
00:28:48,840 --> 00:28:48,920
.

425
00:28:48,920 --> 00:28:48,940
.

426
00:28:52,000 --> 00:28:52,700
.

427
00:28:52,700 --> 00:28:52,720
.

428
00:28:58,720 --> 00:28:59,420
.

429
00:28:59,420 --> 00:28:59,560
.

430
00:29:03,360 --> 00:29:03,640
.

431
00:29:10,860 --> 00:29:11,140
.

432
00:29:11,140 --> 00:29:11,160
.

433
00:29:11,160 --> 00:29:11,180
.

434
00:29:11,180 --> 00:29:11,200
.

435
00:29:11,200 --> 00:29:11,220
.

436
00:29:11,220 --> 00:29:11,260
.

437
00:29:11,260 --> 00:29:11,540
.

438
00:29:12,820 --> 00:29:13,100
.

439
00:29:13,620 --> 00:29:13,900
.

440
00:29:13,900 --> 00:29:14,200
.

441
00:29:15,380 --> 00:29:16,400
.

442
00:29:16,400 --> 00:29:16,520
.

443
00:29:17,660 --> 00:29:18,680
.

444
00:29:18,680 --> 00:29:19,440
.

445
00:29:23,520 --> 00:29:24,540
.

446
00:29:24,540 --> 00:29:24,640
.

447
00:29:24,640 --> 00:29:24,940
.

448
00:29:24,940 --> 00:29:24,960
.

449
00:29:24,960 --> 00:29:25,040
.

450
00:29:26,460 --> 00:29:27,480
.

451
00:29:27,480 --> 00:29:28,200
.

452
00:29:45,000 --> 00:29:46,360
.

453
00:29:48,260 --> 00:29:49,620
.

454
00:29:49,620 --> 00:29:51,380
.

455
00:29:51,380 --> 00:29:51,760
.

456
00:29:51,760 --> 00:29:52,440
.

457
00:29:52,440 --> 00:29:52,460
.

458
00:29:52,460 --> 00:29:52,520
.

459
00:29:52,520 --> 00:29:52,540
.

460
00:29:52,540 --> 00:29:54,100
.

461
00:29:54,100 --> 00:29:56,800
.

462
00:29:56,800 --> 00:29:56,820
.

463
00:30:13,900 --> 00:30:14,120
.

464
00:30:18,860 --> 00:30:19,300
.

465
00:30:28,560 --> 00:30:29,000
.

466
00:30:29,000 --> 00:30:29,120
.

467
00:30:29,120 --> 00:30:29,380
.

468
00:30:29,900 --> 00:30:30,340
.

469
00:30:30,340 --> 00:30:30,980
.

470
00:30:30,980 --> 00:30:31,020
.

471
00:30:31,020 --> 00:30:31,040
.

472
00:30:31,040 --> 00:30:31,060
.

473
00:30:31,060 --> 00:30:31,080
.

474
00:30:34,620 --> 00:30:35,060
.

475
00:30:35,060 --> 00:30:35,260
.

476
00:30:43,900 --> 00:30:44,320
Thank you.