Este curso tem como objectivo dotar os participantes das competências e conhecimentos necessários para defender contra ataques de engenharia social a sua organização, através de técnicas e ferramentas psicológicas de manipulação, deturpação e persuasão utilizados pelos engenheiros sociais.

No final deste curso os participantes saberão:

·         Defender a sua organização contra fraudes de engenharia social que ameaçam a segurança organizacional

·         Planear e avaliar as avaliações de segurança para falhas humanas

·         Promover a vigilância e implementar procedimentos para minimizar fraudes

·         Reduzir as vulnerabilidades de pessoal com a consciencialização da segurança

·         Avaliar a preparação de sua organização para ataques

Este Curso destina-se a todos os profissionais que pretendam adquirir e/ou aprofundar os seus conhecimentos nesta área.

1 -    Introduction to Social Engineering

·         Evaluating the organizational risks

·          Assessing social engineering threats

·          Analyzing classic case studies

·         Thinking like a social engineer

·          Considering attack frameworks

·          Reviewing the methods of manipulation

·          Examining legal issues and social concerns

2 -    Gathering Information and Intelligence

·         Identifying information sources

·          Gathering information passively and actively

·          Leveraging social media

·          Exploiting Google hacking

·         Collecting target information

·          Ripping information from sites with Maltego

·          Dumpster diving for secrets and intelligence

·          Profiling users for passwords

·         Minimizing information leaks

·          Securing information leaks

·          Implementing secure disposal policies

·          Pinpointing reconnaissance probes

3 -    Identifying Communication Models

·         Profiling an information architecture

·          Implementing the Berlo communication model

·          Source

·          Message

·          Channel

·          Receiver

·          Determining communication weaknesses

·         Addressing communication flaws

·          Verifying the source

·          Securing the information channel

4 -    Assessing Elicitation Methods

·         Drawing out information

·          Soliciting information

·          Interview techniques

·          Identifying elicitation tactics and goals

·         Mitigating information leaks

·          Maintaining situational awareness

·          Implementing scripted responses

5 -    Gaining Physical Access

·         Circumventing physical security

·          Identifying weak types of locks

·          Bypassing electronic access controls

·         Securing the environment

·          Implementing high security locks

·          Preventing lock bumping

6 -    Impersonating Authorized Personnel

·         Gaining access with a disguise

·          Identifying spoofing techniques

·          Discovering change blindness deception

·          Assessing Internet impersonation techniques

·         Defending against impersonation and forgery

·          Implementing techniques to verify identity

·          Avoiding skimmers and hidden technology threats

7 -    Employing Psychology for Persuasion

·         Examining human weaknesses

·          Leveraging Cialdini's motivation factors

·          Identifying mindlessness dangers

·          Exploring commitment and consistency vulnerability

·         Compelling behavior

·          Exploiting social proofing

·          Taking advantage of implied authority

·          Demanding action with "quid pro quo"

·         Bolstering resistance to persuasion

·          Adhering to policy and rules

·          Recognizing risky situations

·          Learning to interpret and then recognize

8 -    Implementing Management Countermeasures

·         Assessing social engineering vulnerabilities

·          Conducting a penetration test

·          Creating a scope of work

·          Mitigating legal issues and embarrassment

·         Creating comprehensive policies

·          Establishing verification policies

·          Regulating the use of social networks

·          Delivering effective security awareness training