Social Engineering and Physical Security
Social Engineering and Physical Security
This domain tests authorized human-layer and physical assessments: phishing, vishing, pretexting, tailgating, badge cloning, and lock bypass. The exam emphasizes consent, safety, and measurement over trickery.
Core rules and concepts
- Written authorization must cover the target population, channels, time window, and permitted pretexts. HR, legal, and leadership should know, with a limited need-to-know group.
- Phishing: domain and infrastructure setup, target list, lure, landing page, tracking. Capture credentials only with approval; otherwise use a training page and measure click and report rates.
- Vishing and pretexting: scripted scenarios, caller identity, escalation boundaries, and a stop phrase.
- Physical: tailgating, shoulder surfing, dumpster diving, lock picking, RFID/badge cloning, camera and guard avoidance. Safety of people outranks obtaining access.
- Report both successful and failed attempts; the learning is in the report rate and process gaps.
- Debrief participants promptly and avoid public humiliation.
Worked example
An approved phishing simulation sends 200 employees a fake password-reset notice. The landing page does not store credentials; it displays training and records clicks. Results show 12% click rate and 40% report rate. The tester interviews the service desk and finds reports were not triaged within the hour. The report recommends a one-click report button and faster triage, not punishment. If the page had captured real passwords, that would exceed the agreed scope unless explicitly authorized.
Traps that cost marks
- Running a campaign with verbal permission only.
- Capturing real credentials without explicit approval.
- Using frightening or real-world crisis themes that cause harm.
- Failing to debrief or to measure report rates.
- Attempting physical entry without a safety plan and escalation contacts.