IstroSec offers the opportunity to test the effectiveness and efficiency of your security controls through simulated attacks. In this way it is possible to verify whether:
- Employees are adequately aware of cyber threats
- They can withstand these threats
- Your preventive, detectable and reactive measures work as intended
- The incident management team is able to respond quickly and effectively to incidents
Simulations of attacks by social engineering
IstroSec offers simulations of attacks by social engineering as well as simulations of attacks, where the presence of an attacker in the infrastructure is assumed. Simulations of attacks by social engineering are done through:
- Phishing
- Spearphishing
- Whaling
- Vishing
- Smishing
- Physical social engineering
Comprehensive resilience to attacks by social engineering can be achieved by mature employee security awareness programs, adequate technical controls and regular testing of their effectiveness. IstroSec is ready to help you increase your readiness and ability to withstand these types of attacks.
Phishing simulations
Our experts will prepare and implement a phishing campaign that will not be targeted at specific employees, or the technologies or services used. As part of this campaign, a list of employees’ email addresses will be compiled based on publicly available data. Subsequently, a phishing email will be sent to these addresses in an attempt to solicit login information, personal information or other sensitive information, or download the attachment.
Spearphishig simulations
Spearphishing is a more advanced and more effective type of phishing. In this simulation, our experts use open-source intelligence (OSINT) to obtain the data needed to prepare a targeted and highly effective campaign that will take into account the specifics of your technologies, employees or services used. Very similar domains, bypassing multifactor authentication or deploying specific malware written by our malware analysts are used.
Whaling
As part of the whaling attack simulations, our experts will carry out a spearphishing campaign aimed at the top management of the organization. It is the attack on this group of people that can cause significant damage to an organization by combining their access to critical information and dynamic work styles.
Vishing
Voice phishing attacks can be a very effective way to solicit sensitive information from employees. Our experts will carry out a telephone attack using information from OSINT and employ psychological manipulation, impersonation and fraudulent tricks.
Smishing
We will send phishing SMS messages to your employees to solicit login details, personal data or other sensitive information or download an email attachment.
Physical social engineering
Our experts will visit your workplace and, through communication with employees, will seek information that can be used to conduct other attacks, install malicious software, obtain passwords, sensitive data, or force employees to perform activities that violate the organization’s security policies.
Simulations of an attacker already present in infrastructure
- Simulations of specific activities of the attacker
- Simulation of a complex attack on an organization
Simulations of specific activities of the attacker
Simulations of an attacker’s specific activities in an organization can consist of activities such as lateral movement, the spread of malicious code, data collection and filtering, circumvention of security measures in the organization, and the like.
Simulation of a complex attack on an organization
As part of this type of simulation, we test your security team’s detection and response capabilities for the tactics, techniques, and procedures (TTPs) of advanced persistent threats (APT). If a particular APT group is currently focusing on your business sector, we can help you increase your ability to withstand its specific TTPs. For example, in the case of the APT41 group, it could be spearphishing with a malicious attachment, WMI, scheduled tasks, PowerShell, DLL Side-Loading, SMB / Windows Admin Shares, keylogging, or data encryption as an exit strategy.
Why IstroSec?
In addition to high skills in performing the simulations themselves, IstroSec experts thoroughly study the tactics, techniques and procedures used by attackers in practice. Thanks to this combination, the client can safely test their resilience and readiness for real attacks.