Scribd
Upload
76 views

CEH Lesson 6 - Social Engineering

This lesson discusses physical security, social engineering, and related topics. It covers threats to physical security from natural events, man-made threats, equipment failure and loss of utility. It then describes various equipment controls for physical security including locks, lock grades, and techniques for bypassing locks. The lesson also discusses social engineering techniques like scarcity, authority and consistency that trick people into providing sensitive information. It concludes with an overview of policies and procedures for physical and data security.

Uploaded by

Louise Real
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
76 views

CEH Lesson 6 - Social Engineering

This lesson discusses physical security, social engineering, and related topics. It covers threats to physical security from natural events, man-made threats, equipment failure and loss of utility. It then describes various equipment controls for physical security including locks, lock grades, and techniques for bypassing locks. The lesson also discusses social engineering techniques like scarcity, authority and consistency that trick people into providing sensitive information. It concludes with an overview of policies and procedures for physical and data security.

Uploaded by

Louise Real
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPT, PDF, TXT or read online on Scribd
You are on page 1/ 17

Certified Ethical Hacker

Lesson 6
Physical Security and Social
Engineering
Lesson 6
Objectives

After reading this lesson you will be able to:


 Understand the role of physical security
 Identify the threats to physical security
 Describe equipment controls that could be used
to enhance physical security
 Describe social engineering techniques
Threats to Physical Security

 Can be caused by natural events, man-made events,


utility loss, or equipment failure
 Natural events:
– Floods
– Fire
– Hurricanes and tropical storms
– Tidal waves
– Earthquakes
– Other natural events
Threats to Physical Security cont.

 Man-made threats:
– Theft
– Vandalism
– Destruction
 Equipment failure:
– Mean Time Between Failure (MTBF)
– Mean Time to Repair (MTTR)
 Loss of utility
Equipment Controls
 Locks
– Mechanical
• Warded locks
• Tumbler locks
– Keypad and combination locks
• Basic combination lock
• Programmable cipher lock
– Master key locks
– Device locks
– Ace locks
 Lock grades
– Grade 1 – provides highest security
– Grade 2
– Grade 3 – weakest design
Equipment Controls

 Lock bypassing techniques


– Bump keys
– Lock picking
– Shimmming
 Fax Machines
– Must be placed in secure location.
– If the fax machine uses ribbons or roll refills, those
need to be shredded.
Area Controls

 Solid doors for server rooms


 True floor-to-ceiling walls
 Windows
 Closed-circuit TV cameras
Location Data and Geotagging

 Location data is typically collected in latitudes and


longitudes
 Location data can be collected by
– Geotagging
– Smartphone triangulation
Facility Controls

 Fences
 Lights
 Guards
 Dogs
 Gates
 Locks
 Bollards
 Turnstile
 Mantraps
Personal Safety Controls

 Fire prevention and detection systems:


– Heat activated
– Smoke activated
 Fire suppression systems:
– Class A
– Class B
– Class C
– Class D
Physical Access Control

 Authentication:
– Passwords and pin numbers – something you know
– Tokens, smart cards, and magnetic strip cards – something you
have
– Biometrics – something you are:
• Considered a strong form of authentication
• Fingerprints
• Facial scans
• Hand geometry
• Palm scan
• Retina pattern
• Iris recognition
• Voice recognition
Social Engineering

 Tricking someone into providing information or giving


something they should not
 Types of social engineering:
– Scarcity
– Authority
– Liking
– Consistency
– Social validation
– Reciprocation
Person-to-Person-Based Social
Engineering
 Works on a personal level by using one of the following
techniques
– Important user
– Third–party authorization
– Masquerading
– In person
Computer-Based and Reverse
Social Engineering
 Uses software to retrieve information:
– Pop-up windows
– Email attachments
– Smartphone
– Social networking
– Websites
 Reverse social engineering:
– Sabotaging someone else’s equipment and offering
to fix the problem
Policies and Procedures

 Employee Hiring and Termination policies


 Help Desk Procedures and Password Change policies
 Employee identification
 Privacy policies
Governmental and Commercial
Data Classification
 Governmental information classification systems:
– Unclassified
– Confidential
– Secret
– Top secret
 Commercial information classification system:
– Public
– Sensitive
– Private
– Confidential
Lesson 6
Summary
 Explain the threats to physical security.
 Explain how equipment controls could be used to
enhance physical security.
 Describe how biometric devices could be used for
authentication.
 Describe the types of access control.
 Describe social engineering attacks.
 Describe policies and procedures.

You might also like