tailieunhanh - Module 11 Social Engineering

Social engineering là phương pháp phi kỹ thuật đột nhập vào hệ thống hoặc mạng công ty. Đó là quá trình đánh lừa người dùng của hệ thống, hoặc thuyết phục họ cung cấp thông tin có thể giúp chúng ta đánh bại bộ phận an ninh. Social engineering là rất quan trọng để tìm hiểu, bởi vì hacker có thể lợi dụng tấn công vào yếu tố con người và phá vỡ hệ thống kỹ thuật an ninh hiện tại. Phương pháp này có thể sử dụng để thu thập thông tin trước hoặc trong cuộc tấn công | Ethical Hacking and Countermeasures Version 6 Module XI Social Engineering IM c EH Scenario Certified Ethical Hacker The Internal Revenue Service IRS annually processes over 222 million tax returns which are converted into electronic records on various IRS systems. This information is protected by law and considered sensitive. Mainta ining this type of information could make the IRS a target for computer hackers. In recent years the IRS has successfully completed significant efforts in securing its computer network p erime ters fro 111 extern a 1 c yber threats. B e c au s e ha c k ers are unable to gain access through these Internet gateways into the IRS. they are likely to seek other w ays to gain access to IRS systems and. ultimately taxpayer data. One such method is social engineering which involves exploiting the human aspect of computer security for the purpose of gaining insider information about an organization s computer resources. One of the most common tactics is to convince an organization s employees to reveal their passwords. Along with user account names passwords are needed to identity and authenticate employees before allowing them access to systems and data. In August 2001. with the assistance of a contractor we conducted social engineering tests on IRS employees as part of our penetration testing efforts. We placed calls to 100 IRS employees asking them to change their password to one wre suggested and found 71 employees were willing to accommodate our This review7 W7as conducted from our office in Walnut Creek. California in December 2004. The audit was conducted in accordance with Government Auditing Standards. Detailed information on our audit objective scope and methodology is presented in Appendix I. Major contributors to the report are listed in Appendix II. Source http Copyright by Ec-Council All Rights Reserved. Reproduction is Strictly Prohibited EC-Council IM c E H News Certified Ethical Hacker Social .