Social Engineering and Human-Factor Attacks Questions

Scope & objectives

• I’d define goals (assess entry controls, receptionist procedures, badge tech, insider risk) and explicit out-of-scope items (no forced entry, no hardware destruction, no systems payloads).
• Deliverables: executive summary, technical findings, risk ratings, reproducible evidence, remediation roadmap.

Legal & approvals

• Obtain written Rules of Engagement (RoE) signed by Legal, Security, Facilities and a senior authorizing officer. RoE lists dates/times, allowed tools (test badges, RFID reader), stop-word, escalation contacts, insurance, privacy clauses, and liability limits.
• Get facilities approval for access to restricted areas for testers and an on-call facilities escort if required.

Non-destructive test design

• Controlled tailgating: scripted attempts during peak and off-peak hours using pre-approved testers in normal attire; an observer/reception witness records outcome.
• Badge-cloning reconnaissance: passive scanning to enumerate badge tech (NFC, prox) from public areas only; active cloning only if explicitly authorized and with inert test badges supplied by client.
• Recon limited to surface observations; no tampering with doors, locks, or CCTV.

Social-engineering constraints

• Pre-approved personas and scripts; no coerced or aggressive behavior; no attempts to obtain credentials via phishing or device planting unless separately authorized.
• Use of a “stop word” and immediate withdrawal if staff requests proof or identifies suspicion.

Safety & privacy

• Prohibit photography of private workstations, employee screens, or PII; if imagery required, redact or obtain written consent. Prioritize physical safety—no deception that could endanger staff.

Evidence & admissibility

• Collect time-stamped logs, signed witness statements, photos of public-facing controls (with redaction), tool output, and video only if pre-authorized. Maintain chain-of-custody: file hashes, centralized secure storage, and RoE-linked signatures.

Reporting & remediation

• Provide prioritized findings (Critical/High/Medium/Low), root cause analysis, reproducible steps, and mitigation tiers:
  • Process: enforce badge validation, tailgate-aware reception scripts, visitor escort policy.
  • Technical: upgrade to mutual authentication readers, anti-passback, alarms.
  • Training: targeted receptionist and employee awareness, testing cadence.
• Offer retest plan and executive briefing for leadership.