We are trying to get together a list of best practice controls and countermeasures to thwart any social engineering type attacks against our IT helpdesk. The main concerns we identified or ways a social engineer could try and attack us were users (impersonate an employee) trying to get new network or application accounts setup, password resets, requesting their passwords by passed over the phone, (impersonate a network admin) request configuration details of servers and applications over the phone.
Have we considered every way a social engineer would operate to attack a helpdesk or would there be other ways or types of information that would be tried to be lured out a helpdesk?
What controls and procedures do you train your IT helpdesk staff so they dont fall victim to social engineer, i.e. ask the person logging the call with the helpdesk some security questions to check they are who they say they are? Any other techniques outside of security questions that you use or could recommend? Or do you not divulge anything sensitive over the phone, do you use email to communicate sensitive data?