Evan Schuman's StorefrontBacktalk

Why should social engineering be a crucial element in every retailer’s pen testing? Because every retailer on the planet is already being phished, and if you can learn the lessons before the bad guys do, your organization might avoid a very unpleasant experience. According to Verizon’s 2013 Data Breach Investigation Report, social engineering tactics like phishing were four times more common in 2012. The reason for this increase is simple: Phishing succeeds. The reason is “flaws in the carbon layer” (i.e., people). One statistic in the report discussed the inevitability of success by describing how if the bad guys sent three phishing emails, the odds are over 50 percent that one recipient will click on the attachment.

Adding social engineering attacks to a pen test does not have to be expensive or extensive. The difference is that your own pen testers conduct the attacks and analyze the results. Working with the retailer’s training department, these examples provide exquisitely teachable moments to increase awareness and decrease vulnerability with live examples. Like many pen testers, when we pursue social engineering, then testing it often is a combination of email and telephone scenarios. The goal is to identify weaknesses that the client can address.

It is important to add that any social engineering pen test has to be conducted under the principles of no harm, no foul. Specifically, blame cannot be part of the review, and in cases I’ve seen, we don’t even need to identify which person took the bait. The purpose is to learn and reduce the odds of a data breach, not to punish call center, help desk or other internal staff.

**************

I’d like to end this column with a personal note. This is my last column as StorefrontBacktalk’s PCI columnist. Since late 2009, when I was privileged to write my first column, it has been a labor of love. I want to thank all of you who left comments, sent emails with your thoughts, corrected me when I was wrong, argued for or against my position, or just related to me your own personal experiences. I read and treasured each comment.

I know I will continue to follow StorefrontBacktalk.com regularly for its great content and writing. It is just that it is time to pass the PCI columnist torch to others. I’ve shared most of my personal opinions and insights as a QSA working with merchants of all sizes across the country. Thank you for sharing the journey with me.