Two methodologies for physical penetration testing using social engineering

Proceedings - Annual Computer Security Applications Conference, ACSAC

Volumn , Issue , 2010, Pages 399-408

  Dimkov, Trajce ^a   Van Cleeff, André ^a   Pieters, Wolter ^a   Hartel, Pieter ^a  

^a UNIVERSITY OF TWENTE   (Netherlands)

Author keywords

methodology; penetration testing; physical security; research ethics; social engineering

Indexed keywords

IT SYSTEM; LAW SUITS; METHODOLOGY; PENETRATION TEST; PENETRATION TESTING; PHYSICAL SECURITY; RESEARCH ETHICS; SOCIAL ENGINEERING; TEST ENGINEERING;

EID: 78751537277     PISSN: 10639527     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1920261.1920319     Document Type: Conference Paper

References (16)

1. P. Finn and M. Jakobsson. Designing ethical phishing experiments. Technology and Society Magazine, IEEE, 26(1):46-58, Spring 2007.
2. C. Soghoian. Legal risks for phishing researchers. In eCrime Researchers Summit, 2008, pages 1-11. IEEE, 2008.
3. C. Greenlees. An intruder's tale-[it security]. Engineering & Technology, 4(13):55-57, 2009.
4. Wil Allsopp. Unauthorised Access: Physical Penetration Testing For IT Security Teams, chapter Planning your physical penetration test, pages 11-28. Wiley, 2009.
5. P. Herzog. OSSTMM 2.2-Open Source Security Testing Methodology Manual. Open source document, www.isecom.org/osstmm, 2006.
6. N. Barrett. Penetration testing and social engineering hacking the weakest link. Information Security Technical Report, 8(4):56-64, 2003.
7. S. Türpe and J. Eichler. Testing production systems safely: Common precautions in penetration testing. In Proceedings of Testing: Academic and Industrial Conference (TAIC PART 2009), pages 205-209. IEEE Computer Society, 2009.
8. D. B. Cornish. The procedural analysis of offending and its relevance for situational prevention. In R. V. Clarke, editor, Crime Prevention Studies, volume 3, pages 151-196. Criminal Justice Press, Monsey, NY, 1994.
9. National Commission for the Protection of Human Subjects of Biomedical and Behavioral Research. The Belmont report: Ethical principles and guidelines for the protection of human subjects of research. pages 1-18, 1978.
10. P.R. Finn. Research Ethics: Cases and Materials, chapter The ethics of deception in research, pages 87-118. Indiana University Press, 1995.
11. D.B. Cornish and R.V. Clarke. Opportunities, precipitators and criminal decisions: A reply to Wortley's critique of situational crime prevention. Crime Prevention Studies, 16:41-96, 2003.
12. G. Kitteringham. Lost laptops = lost data: Measuring costs, managing threats. Crisp report, ASIS International Foundation, 2008.
13. R. Willison and M. Siponen. Overcoming the insider: reducing employee computer crime through situational crime prevention. Communications of the ACM, 52(9):133-137, 2009.
14. B.L.A. Goodman. Snowball sampling. The Annals of Mathematical Statistics, 32(1):148-170, 1961.
15. D. Baumrind. Research using intentional deception. Ethical issues revisited. The American psychologist, 40(2):165-174, 1985.
16. Code of Federal Regulations. Title 45: Public welfare department of health and human services. part 46: Protection of human subjects. pages 1-12. 2005.