In this lesson,
we are going to learn about awareness
and training considerations.
Awareness and training considerations
are a part of Security Program Management.
These considerations include educating employees
about security risks such as phishing, social engineering,
physical security, and privacy practices.
Employees learn about security through
initial and recurring training,
which enhances situational awareness
and promotes operational security known as OPSEC.
In this lesson, we will use
the Social-Engineer Toolkit, or SET,
to demonstrate the importance of situational awareness
and the impact of social engineering
on operational security and privacy.
The Social-Engineer Toolkit is an open-source tool
used to simulate social engineering attacks,
such as phishing and credential harvesting
through malicious websites.
As a training tool,
the Social-Engineer Toolkit can expose employees
to realistic attack scenarios such as credential harvesting.
Additionally, the Social-Engineer Toolkit highlights
operational security by showing how easily
sensitive information such as login credentials
can be compromised if employees are not vigilant
about where they enter data.
Furthermore, this type of simulation
reinforces security training by offering a real world
and interactive example attack,
teaching employees to recognize and avoid
manipulation attempts that could lead
to credential compromise.
Training with the Social-Engineer Toolkit
also emphasizes the importance of privacy,
as credential harvesting directly
exploits personal information.
Finally, the Social-Engineer Toolkit may also be used
to expose users to phishing strategies,
improving their situational awareness
and ability to detect fraudulent websites
and suspicious links.
Before we conduct the demonstration,
let's define the terms operational security,
physical security, privacy, social engineering,
phishing, and situational awareness.
First, we have operational security.
Operational security includes processes and practices
designed to protect sensitive information
from being inadvertently exposed.
It focuses on identifying critical data
and controlling its dissemination to mitigate risk.
Second, we have physical security.
Physical security involves protecting
an organization's assets, facilities and personnel
from unauthorized access or harm
through measures like surveillance,
access control systems, and secure entry points.
Employees should be trained to identify and respond
to physical security threats,
ensuring safety of both people and infrastructure.
Third, we have privacy.
Privacy is the practice of safeguarding
personal and sensitive information from unauthorized access.
It involves ensuring that data is handled securely
and in compliance with legal and regulatory standards.
Fourth, we have social engineering.
Social engineering refers to manipulation tactics
used by attackers to trick individuals
into divulging confidential information.
This manipulation is often done by exploiting
human psychology rather than technical vulnerabilities.
Fifth, we have phishing.
Phishing is a form of manipulation
where attackers use fraudulent communications,
typically emails, to trick individuals into taking an action
like clicking on a link or revealing sensitive information.
Sixth and last, we have situational awareness.
Situational awareness is having a clear understanding
of the current threat landscape, recognizing potential risks
and maintaining constant vigilance
to detect and respond to security incidents as they arise.
Now, let's get to that demonstration.
I am logged in to a virtual machine
running the Kali Linux operating system.
My IPv4 address is 10.0.2.15.
And as you can see, I have a Terminal window open.
Overall, in this demonstration,
we are going to use this Social-Engineer Toolkit
to create a fake website to harvest credentials.
So, the first thing I'm going to do
is enter in the command, sudo setoolkit, to start it up.
As you can see here,
the Social-Engineer Toolkit is menu-based.
I'm going to select option one for a social engineering attack.
On this next menu, I'm going to select option two
for a website attack vector,
but please notice that we could select option one,
a spearfishing attack vector,
or option five, a mass mailer attack.
On this next menu,
I need to choose how I'm going to do the attack,
and I'm going to choose option three,
a credential harvester attack method.
On this menu here, I need to choose how I want to
present or how I want to create the website
that is going to be used.
I'm going to use option one, a web template.
Now, I need to choose where I'm going to host
that malicious website.
My IP address, which we've already seen, is 10.0.2.15.
So that's already pre-populated for me here,
I'm just going to select Enter.
All right, we are almost ready to go.
The last thing I need to do is choose what website
I want to use as that malicious template.
I could use a Java, a Google, or a Twitter template.
I'm going to choose Google.
All right, it is up and running.
My Kali Linux machine is now hosting a malicious website
that will harvest credentials and capture those credentials
for me right here in this command line.
So, the next thing I need to do is go out and find a victim.
Let's say I was running an internal phishing test
and a user clicked on the link
that I had provided for them,
directing them to my credential harvesting website.
I'm going to simulate that by opening up Mozilla Firefox
and navigating to my local host machine.
There it is, that is the website that I am hosting,
which is the malicious credential harvesting website.
So, I'm going to go ahead and enter in some credentials.
I'll enter in my name, Jeremiah, I'll enter in a password,
capital, P-A-S-S-W-0-R-D,
and then I'm going to go ahead and try to sign in.
Huh?
I don't want to save those credentials,
but look, it didn't work, I wasn't able to sign in,
but now here I am at another Google page.
All right, well, I can click sign in here.
Now that I'm on the actual Google page I was redirected to,
I could sign in with my actual credentials,
and log into Google.
Now, my credentials have been harvested in the background.
I can see that if I go back to this command line,
you can see here that it tells me
that it found a possible username of Jeremiah
and a possible password of capital, P-A-S-S-W-0-R-D.
Those are the username and password that I entered
into that initial credential harvesting website.
This is an example of the Social-Engineer Toolkit
being used to harvest credentials,
and that's the end of this demonstration.
So, remember, awareness and training considerations
are essential to security program management.
Training should focus on educating employees
about risks resulting from phishing,
social engineering,
physical security deficiencies, and privacy concerns.
Training through tools like the Social-Engineer Toolkit
enhances situational awareness
by simulating real world attacks,
which can help employees recognize
and avoid security threats.
Training simulations are used
to emphasize operational security
by showing how easily sensitive information
can be compromised if employees are not vigilant.
Training also reinforces
the importance of protecting privacy,
as attackers often attempt to exploit personal data.
By regularly conducting security and awareness training
organizations improve their overall security posture,
ensuring employees remain prepared for evolving threats.