social engineering / helpdesk

We are trying to get together a list of best practice controls and countermeasures to thwart any social engineering type attacks against our IT helpdesk. The main concerns we identified or ways a social engineer could try and attack us were users (impersonate an employee) trying to get new network or application accounts setup, password resets, requesting their passwords by passed over the phone, (impersonate a network admin) request configuration details of servers and applications over the phone.

Have we considered every way a social engineer would operate to attack a helpdesk or would there be other ways or types of information that would be tried to be lured out a helpdesk?

What controls and procedures do you train your IT helpdesk staff so they dont fall victim to social engineer, i.e. ask the person logging the call with the helpdesk some security questions to check they are who they say they are? Any other techniques outside of security questions that you use or could recommend? Or do you not divulge anything sensitive over the phone, do you use email to communicate sensitive data?
Who is Participating?
Dave HoweConnect With a Mentor Software and Hardware EngineerCommented:
do regular testing would be my best recommendation - give them deliberately fuzzy-timescale warnings like "we will be performing Social Engineering testing next month - anyone who gives out internal information, particularly usernames, passwords, names of people in roles or internal phonebook numbers, will have their photo and details of the leak posted to a 'wall of shame' noticeboard near the employee entrance for one month" - actually doing the pentesting is optional.

Work up a few example scripts and distribute them, ideally on an internal website (saves costs, and you can even record some audio files for playback and host them there)

if your company structure is appropriate, try posting the audio files (and transcripts) to a site, and offer a small prize for the best summary of the issues revealed, recommendations for ways to politely refuse information and so forth. the answers themselves aren't important, but the benefit is in getting people thinking about the transcript, in context, and what they would do to avoid that attack.
Dave HoweSoftware and Hardware EngineerCommented:
first pass for social engineering attacks usually targets names of internal staff (particularly senior management or senior technical), email addresses for them, direct dials (etc etc)

not only useful for "cover" when doing later social engineering, but valuable in their own right (to telemarketing and recruitment types)
pma111Author Commented:
Hi Dave, Do you mean they may ring up the helpdesk asking for employees contact names and details etc?
Dave HoweSoftware and Hardware EngineerCommented:
pretty much. A typical script would run something like "Hi, I am from <name of big company> and need to talk to <name you never heard of> in accounts - however, his email bounces with a message saying he has left the company. Can you tell me who has replaced him in Accounts Receivable?"

"Oh, ok. is he on <standard number with 123 added to the last three digits> like <guy mentioned> was?"


"so, would that be <guy's first name>.<guy's last name>@<company domain> ?"

the important thing is to get another line into the company bypassing the helpdesk; normally, people who aren't on the helpdesk will transfer you almost anywhere to get rid of you if you "accidentally" dial the wrong number (so it is worth trying random numbers a couple up from the helpdesk/general dial number, to see who answers). you can also usually convince people that you are an internal caller if you are transferred, but that depends on their telephony solution.

your helpdesk/reception/published number is like a perimeter firewall - you can get it to the point where it is impenetrable, but that's no use if someone can connect in by another method and bypass it entirely.  that is why, once you have a name, trying random numbers can help - you can often get them to transfer you or even tell you your target's extension (and direct dial usually maps directly to the extension number)
pma111Author Commented:
Thanks DaveHowe, Do you have any generic suggestions how to protect against SE, and to tighten the helpdesk to act as a tight permiter firewall
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.