.avif)
.svg)
Social Engineering Testing
NETBankAudit’s In-depth Social Engineering Testing is designed to evaluate the effectiveness of your institution’s security awareness training and the resilience of your staff against real-world social engineering attacks. Our methodologies and automated tools are tailored to provide meaningful, actionable results without prohibitive costs to your information security budget. We work closely with management to customize the approach and ensure testing aligns with your goals and organizational culture.
Our social engineering testing program includes a variety of simulated attack scenarios to assess your institution’s vulnerability to human-based threats. Each component is designed to test specific aspects of your security awareness and response protocols.
Email Phishing Social Engineering Test
- Simulated Phishing Campaign: NETBankAudit provides an email phishing social engineering test for all employee email addresses. The bank selects one standard email template to send to employees; no customization or alterations are available for this standard test.
- Response Tracking: We collect information on employees who visit the phishing website and any data they provide. This information is documented in the final report, with specific names provided in a supplemental report.
- Advanced Options: Customized in-depth phishing tests are available, including Spear Phishing, Cybersecurity Spear Phishing, and Advanced Social Engineering testing. Please inquire for more details.
Pretext Calling Social Engineering Test
- Simulated Pretext Calls: Our engineer, acting as a social engineer, attempts to obtain access to the network by calling a selected target group of employees and posing as a network engineer working with the IT department on network testing.
- Test Scenario: The engineer asks the employee to help with the test by going to a website to see if they can access it. The website records information regarding any visits by the employee.
- Sample Size: Typically, a sample size of 10% of employees (up to 15 contacts) is used for this test.
Onsite Visit Social Engineering Test
- Unannounced Branch Visits: The face-to-face social engineering testing consists of unannounced visits to selected branches to determine how well employees follow organizational protocol when asked to provide access to secure areas of the branch.
- Test Scenario: Our engineer, acting as a social engineer, arrives at the designated location(s) without prior warning, introduces themselves as a NETBankAudit consultant working with the IT Administrator, and requests access to the server room.
- Response Documentation: The subsequent response(s) of the target employee(s) are recorded in the final report. This test helps assess the effectiveness of physical security and employee training in real-world situations.
- Sample Size: Typically, this test is performed at one or more branch locations as agreed upon with management.
Testing Approach and Customization
We collaborate with your management team to determine the best approach for social engineering testing, ensuring that the process achieves your goals without negatively impacting employee morale. Planning and preparation are essential to customize the testing for your institution and to minimize the risk of misunderstanding among staff.
- Management Coordination: NETBankAudit seeks direction from management to select the most appropriate social engineering tactics and to agree on the scope and sample size for each test.
- Employee Communication: Guidelines are established to ensure employees understand that testing is designed to improve training and awareness, not to measure individual performance.
- Planning and Preparation: NETBankAudit prepares and customizes social engineering testing for each client, ensuring the process is effective and minimally disruptive.
Deliverables
Our social engineering testing provides actionable insights and clear documentation to help you strengthen your institution’s human defenses.
- Detailed Reports: Final report documenting the results of each test, including employee responses and areas for improvement.
- Supplemental Reports: Specific names and details of employees who responded to phishing or pretext tests, provided as a supplemental report.
- Recommendations: Actionable guidance for improving security awareness training, policies, and procedures based on test results.
.svg)
.avif)
