The purpose of Social Engineering attackers is one of two things:

• They want to disrupt a company’s operation by tampering with its data, or
• They want to steal data and/or money.When posing as IT helpdesk staff, for example, an intruder could act as a user and ask for personal information such as a username and password.

The fact that so many individuals are willing to give over their personal information, especially if it appears to be coming from a reputable representative, is astonishing. Essentially, social engineering is the use of deception to persuade others to give up their personal information or data to gain access to it.

Some common and popular social engineering tactics are as follows:

• Phishing. With this tactic, fake emails are sent to victims to encourage them to click on malicious links or download malicious attachments.
• Scareware. Scareware is used to scare the victim into downloading malicious software.
• Baiting. This tactic makes false promises to lure a victim into a trap.
• Honeytrapping. The attacker sets up a fake online profile to build a relationship with the victim to trick them into parting with money or personal information.
• Business email compromise. Business email compromise allows one to pretend to be someone trustworthy to gain a victim’s trust and get them to do something they wouldn’t normally do, such as transfer large sums of money to an unknown bank account (that belongs to the attacker).
• Tailgating. Tailgating is a physical breach in which an attacker gains access to a physical facility by following an employee or asking them to grant them access (e.g., by holding the door or by swiping their electronic ID card).

Social Engineering Penetration Test process

Social engineering penetration testers systematically design and execute attacks. They gather information about the target through reconnaissance and open-source intelligence (OSINT). They select victims and use tactics similar to real attackers. Testers define the scope, conduct tests, document findings, and report risks to management. The pen test report includes impact assessment and recommendations for risk mitigation.