The Aftermath of a Social Engineering Pentest - Are We Being Ethically Responsible?
summary
Social engineering tests use phishing emails, physical pretexting and fake IDs and produce concrete harms: a 2011 conference yielded 66% click rate among security authors, a retail test let 3 of 4 stores’ staff hand over system access, and reports have led to firing and even a nurse’s suicide. The argument: one individual failure signals systemic weakness; planned debriefs, HR involvement, anonymity and no-punishment policies reduce long-term harm (months of rumination) and restore trust.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:37Who am I
- 1:25Outline
- 2:03History
- 3:33Twitter Messages
- 5:58Big World Stories
- 9:59The Blame Game
- 11:48The Report
- 14:24Systemic Failure
- 16:35Debriefing
- 20:23The Sims
- 24:15Security Culture
- 27:46Consequences
- 29:06Responsibility
- 30:31Takeaways
- 32:34References
- 33:04Questions
related talks
01h 03mSocial engineering pentesting. - How it is done, and what you should think about
30mSecurity Starts With You: Social Engineering
35mProtecting the Organization: The Psychology of Social Engineering
44mHacking Humans: Social Engineering Techniques
41mHacking Humans : Social Engineering Techniques and How to Protect Against Them
46mSocial Engineering Attacks in Practice
25mHacking the human mind: The rise of social engineering security threat
58mSocial Engineering: Hacking Humans