Roshan Mani wrote:
Hi Rajesh,
First of all what is a social engineering attack? In my opinion, this is
a method of attack where the attacker exploits certain human tendencies
to gain the confidence of an individual in order to launch an attack
against either the individual or some other target!
===============================
Greetings Roshan/Rajesh and All,
Few days back we have released Information Systems Security Assessment
Framework (ISSAF) Draft0.1, check it out here:
http://www.oissg.org/issaf direct download:
http://oissg.org/issaf01/issaf0.1.zip News is given below.
It has a well written chapter on Social Engineering, covering required
test cases for social engineering assignment. I hope you will find it
useful.
Your feedback on this will be highly appreciated.
ISSAF Preface:
Today, the evaluation of Information Systems (IS) security in accordance
with business requirements is a vital component of any organizations
business strategy. While there are a few information security assessment
standards, methodologies and frameworks that talk about what areas of
security must be considered, they do not contain specifics on HOW and
WHY existing security measures should be assessed, nor do they recommend
controls to safeguard them.
The Information System Security Assessment Framework (ISSAF) is a peer
reviewed structured framework that categorizes information system
security assessment into various domains & details specific evaluation
or testing criteria for each of these domains. It aims to provide field
inputs on security assessment that reflect real life scenarios. ISSAF
should primarily be used to fulfill an organization's security
assessment requirements and may additionally be used as a reference for
meeting other information security needs. ISSAF includes the crucial
facet of security processes and, their assessment and hardening to get a
complete picture of the vulnerabilities that might exists.
The information in ISSAF is organized into well defined evaluation
criteria, each of which has been reviewed by subject matter experts in
that domain. These evaluation criteria include:
* A description of the evaluation criteria.
* Its aims & objectives
* The pre-requisites for conducting the evaluations
* The process for the evaluation
* Displays the expected results
* Recommended countermeasures
* References to external documents
A draft version of this framework is available at OISSG website at:
http://www.oissg.org/issaf
The Information System Security Assessment Framework (ISSAF) is an
evolving document that will be expanded, amended and updated in future.
To improve the usefulness of the future release of ISSAF, please take a
moment to evaluate it. Your feedback is invaluable to OISSG's efforts to
fully serve the profession and future ISSAF releases. The feedback form
is given at the end of ISSAF; please email your feedback at
feedback@oissg.org <mailto:feedback@oissg.org>. We will get back to you
ASAP.
Introduction to OISSG:
Open Information Systems Security Group (OISSG) is an independent and
non profit organization with vision to spread information security
awareness by hosting an environment where security enthusiasts from all
over the globe share and build knowledge.
Thanking you.
Respectfully,
Balwant Rathore
Open Information Systems Security Group
www.oissg.org <http://www.oissg.org/>
Yahoo! Groups Links
<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/CISSP-Discuss/
<*> To unsubscribe from this group, send an email to:
CISSP-Discuss-unsubscribe@yahoogroups.com
<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
