![](bg7.png)
Level 4: Allows physical on-site access to information systems
Well prepared phishing mails mean a huge threat, since they are very efficient and
low effort attacking tools. Thus, we further distinguish between different kinds of
phishing mails at each level, to cover a broad area of attacks. Therefore, exploitation
and preparation mails are sent. The main aim of exploitation mails is to infect the
victim’s computer with a malicious file. Thus, within an exploitation mail the auditor
counts how many people would download a file (i.e. PDF). However, the main aim of
a preparation mail is to persuade the victim to enter personal information (i.e. e-mail,
name, and password) into a web form. Therefore, the auditor guides the victims to a
manipulated website where they shall enter their data.
Since it may not be possible to conduct all tests that are proposed, due to a rising
detection risk with each test, the selection of tests is very important. Therefore, the
auditor first needs to have conducted information gathering (Process visualized in
Figure 2a) and a specification and ordering of the attack scenarios by the following
properties: available information (the more the better), risk level (the higher the
better) and detectability level. We have developed an algorithm for this process; a
diagram can be seen in Figure 2b.
To get an effective insight without immense costs, we recommend conducting
attacks beginning with the lowest level of detectability, until one level of attack was
successful. An attack can be hold as successful if at least 10 to 30 per cent of victims
fall for it (empirical value has to be confirmed in further research). That way, it is
possible to make a statement concerning the security of the organization under test. It
is recommended to send at least one preparation and one exploitation mail per level,
but at best also physical on-site and phone scenarios should be conducted. As a matter
of course, the attacks with a higher risk level (within the same level of detectability)
are more relevant and should be conducted with priority.
The algorithm for choosing these attacks is as follows: The auditor has to define a
priori how many attacks she would like to conduct per level (minimum is two, as
there needs to be at least one preparation and one exploitation mail). Then, found
information is entered. Based on these findings our algorithm evaluates which attacks
got the most information and should be conducted in a more sophisticated way.
Within this ordered list, the assigned risk value is not considered. Therefore, the
algorithm does two bubble sort iterations where values with a higher risk level are
preferred. Based on the resulting list, attacking proposals for the different kinds of
attacks can be given. Thus, the algorithm’s final output proposes a list of different
exploitation/preparation/physical attacking scenarios for each level. Thereby, there
are always two to four more scenarios proposed than the auditor has specified a priori.
This leaves some freedom in choice of attacking scenarios since an algorithm cannot
estimate the whole situation as the auditor can do.
In the following, we describe some of the attack scenarios listed in our knowledge
base. We start with an exploitation attack: New Documents (Detectability: 1, 2; Risk:
2) - The auditor pretends to introduce new security documents that should be noticed
by all employees working at Computer-Workstations since “there are very important
changes”. Thus, she attaches a (manipulated) PDF file that gives her access to the
opener`s computer. Information that helps at this scenario is i.e. email naming
convention, a public forum or IT support handling. But furthermore, we also propose
some preparation scenarios, e.g.: Event Registration (Detectability: 1, 2; Risk: 3) -
44