Social Engineering and Open-Source Intelligence for Security Teams
3-day in-person course
Social engineering attacks continuously remain at the top of the threat landscape and data breach reports. But although these reports tend to simplify many breaches as the result of a successful phishing attack, the reality we get from current threat research is evidently more complex. Social engineering attacks have been evolving. Today, the pathway that leads to that successful phishing email is often the result of a larger attack kill chain based on target research and good open-source intelligence that helps attackers identify organizational vulnerabilities in an often-multi-layered methodology. But it doesn't stop there. Weaponized psychology is still a strong component of those attacks.
In this threat landscape, it is paramount for security professionals & teams to better understand how social engineering works, and how to proactively identify and disrupt attack verticals.
This class provides participants with the necessary skills & knowledge on open-source intelligence, weaponized psychology, and the most recent social engineering tactics, techniques and procedures (TTPs) from cyber criminal groups and state-sponsored APTs.
This is an in-depth, intensive class that will help security teams get a comprehensive understanding of social engineering and build better protective measures (proactive & reactive) and inform their security strategy.
The class also helps penetration testers improve their attack scenarios, their recommendations and provide better and more realistic insights to their clients. The training includes a special section on artificial intelligence both for OSINT and social engineering, as well as insights on the present & future of social engineering attacks.
Attendees will leave this class having acquired the psychological knowledge along with the technical capability to simulate social engineering attacks and improve their prevention & response capabilities
Course Overview
Each module of this training is designed to support the next one.
We start by learning what social engineering is (briefly), and the types of frequently-used social engineering attack scenarios that we have been observing. Real-life case studies are presented and analyzed.
We move on to more practical parts: How did these attacks come to life? What was the background information that they were built upon, and what elements made them successful? Most often, good social engineering is based on excellent intelligence, most of which is collected from open sources.
During the open-source intelligence (OSINT) modules, participants get to see where and how attackers collect people and business information, what tools they use, and how to combine and analyze those information into intelligence that produces useful insights. We focus on two main areas: OSINT for business details and for persons. We will also explore the capabilities and limitations of GenAI and LLMs for OSINT tasks.
We move on to more complex attack methodologies, and emerging threats. We will discuss advanced social engineering attacks and focus on the modus operandi of advanced threat actors through real cases. Participants will also get to learn how AI technology impacts threat actor capabilities. We will practice on the theory through hands-on exercises.
During the last part of the class, we will discuss what security professionals can do to improve their security posture against social engineering attacks on a strategic and tactical level. We will discuss reducing risk, becoming a less attractive target, informing the security strategy, and responding to social engineering attacks.
Hands-on exercises are included throughout the class.
Agenda
Day 1
Introduction
Case study
Attacking the human – OSINT, good social skills, and the right technology
The current threat landscape
Ethics
Social Engineering – Classic Attack Vectors & Their Evolution
Phishing, vishing, and impersonations (may be covered briefly – depending on previous knowledge)
Frequent social engineering pretexts that keep succeeding
Cases & examples from real life attacks
The OSINT data behind the attacks discussed
Social Engineering Kill-Chain
Exercise: identify the attack chain followed in a recent, real- life attack. Correlate with cases previously discussed and note the patterns.
Weaponized Psychology
Influence & manipulation techniques
Universal triggers & our human hard-wiring
Perception manipulation
Cognitive functions in spotting attack attempts
Biopsychology during a suspicious encounter
Open-Source Intelligence (OSINT)
OSINT as a risk identification & mitigation tool
Creating social engineering attacks based on good OSINT
Setting up your workspace & tools
Fundamentals of OSINT - using tools wisely
Search techniques
Useful tools
Day 2
Business OSINT
Search Techniques
Discovering sensitive files & documents
Finding physical security vulnerabilities
Collecting important information on the company
Supporting tools
Creating an organizational chart
Identifying the internal hierarchical dynamics
Internal culture & relationships
Incorporating the intelligence collected within a social engineering kill-chain scenario
People OSINT
Finding contact details (email addresses & phone numbers)
Identifying key people
Social media intelligence (SOCMINT)
Who makes a good target?
How to identify overwhelmed employees/departments
Tailored attacks: Profiling people
Case studies
LLMs for OSINT Tasks
Introduction & tools
Critical thinking: capabilities & limitations
Prompt engineering
Specific techniques for OSINT tasks
Risks, limitations, common mistakes
Demonstration & exercises
Day 3
Elaborate Social Engineering Attacks
Hybrid attacks; types
Case studies
Why did they work? How do we disrupt them?
Targeted, tailored attacks
Kill-chain of tailored attacks
APTs & advanced social engineering
Currently prevalent social engineering scenarios from APTs
Weaponizing Psychology on Specific Targets
Individual psychological triggers
Engaging a key person online & offline
Elicitation techniques
Why do these campaigns work?
Examples
Defense measures
Artificial Intelligence & The Evolution of Attacks
The current impact of AI on threat actor activities
AI-enhanced:
Targeting & reconnaissance
Phishing campaigns
Deepfakes; vishing & impersonations
Capabilities & Limitations : A Realistic View
Disrupting Social Engineering Attacks & Creating a Defense Strategy
Thinking & acting strategically
OSINT: identifying, managing, and eliminating risks
Minimizing or disrupting social engineering attack verticals
Organizational best practices
Employee awareness; benefits & limitations
Exercises are included throughout the class
Target Audience
Penetration Testers & Red Teamers
CISOs & Security team leaders
Government employees (law enforcement, military, etc.)
Intelligence professionals in the private & public sectors
Security professionals tasked with understanding the cyber threat landscape and developing counter measures against social engineering (in the past this has included: CISOs and cybersecurity directors, along with their teams. People within a variety of security roles have taken this training.)
Training level
Beginner/ Intermediate
Pre-requisites
The class is beneficial to beginner/intermediate levels of security professionals with some or none previous knowledge on social engineering attacks and/or OSINT.
It is recommended to come to class with a laptop/device that can connect to the internet, with an updated operational system and browser(s). This will ensure smooth participation in the exercises.
You do not need to have admin privileges on the device.
Having an account/access to an LLM tool is helpful but not a requirement.
Trainer Bio
Christina Lekati is a psychologist and intelligence analyst working in cyber security. She specializes in the human element of cyber-attacks, open-source intelligence investigations, and in vulnerability assessments. Christina has participated in penetration tests, law enforcement training, organizational trainings, high-value target & corporate vulnerability assessments, and more. She is an expert in social media profiling and analysis of the modus operandi, and in the process of identifying personality traits, behavioral tendencies, and demographic variables of both offenders and victims. She is working with Cyber Risk GmbH as a lead intelligence analyst & social engineering consultant and trainer. Christina is frequently invited as a speaker or keynote speaker at cyber-security events around the globe. She was an Executive Board Member at the OSINT Curious project, contributing to the international scene of Open-Source Intelligence (OSINT) with the most recent news, tools and investigative techniques.
