8 simulated attacks performed; 4 different vectors used
Challenges
The client, a large European transport company, had to review the state and current level of security of their IT systems and equipment which were deemed highly business critical. For this purpose, the organization needed experienced Cyber Security experts to perform checks and penetration tests.
Furthermore, as an addition to security awareness trainings that were conducted on an annual basis, the client wanted to measure the current level of Cyber Security understanding of their employees and how they would react to social engineering threats.
Last but not least, the client was looking for a trusted Cyber Security advisor to propose corrective actions, if necessary, for increasing their current level of security to meet modern norms and standards in the field.
Solution
During the project, a series of tests were conducted by DIGITALL consultants. They successfully performed checks in various areas to verify the level of information security of IT systems and facilities. The following four different vectors of social engineering types were tested:
- USB attack
- Spear phishing
- Smishing
- Vishing
All social engineering penetration tests performed were specially developed based on predefined scenarios. The project was completed on time without any operational problems and negative impact on production systems. During the tests, no malicious actions were inflicted on the users and IT infrastructure of the client.
At the end of the project, the customer received a detailed report containing all executed activities, the success ratio, and recommendations.
The client realized that running a security awareness campaign once per year is not enough to ensure their employee’s security awareness and training. Therefore, steps have now been taken to introduce a continuous awareness program.
