5

I'm learning to become a Red Teamer, which simulates attacks by adversaries from multiple angles: Digital/Cyber, Physical and Social. This questions focuses on the Social Engineering aspect of Red Teaming, mainly what comes after engagements.

In Red Team engagements, we often interact with many people and social engineer then to do things like extract information, get unauthorized access, etc. As far as I know, such interactions often only last for a few seconds or minutes, sometimes a day or two. The chances of meeting the social engineered people after engagements are rare (how rare is it really?) but not non-existent.

When a PenTester/Red Teamer meets and talks with one of the people they've social engineered (tricked) outside of work and they recognize the PenTester/Red Teamer, they may ask things like "Hey you're that elevator guy from last week." or "You're the guy from Cisco! Can I get your number in case we get another problem?". In such cases, the profession was disguise and a lie.

If met with such interactions, what should the PenTester/Red Teamer do? Are there some policies and/or rules regarding such situations? Should we just lie to them and say "Yeah I work with elevators" or should we tell them something like "Oh I'm actually a Security Tester. That was a disguise"?

(I suppose we can tell them the truth but that may make it awkward and complicated. It may also make it harder if the next job happens to involve the same person.)

Improve this question
6
  • I'm not an expert at Red Teaming but I would've thought that it would make sense where-ever practical to recruit social engineers out of area to minimise the chances of them bumping into "hacked" clients afterwards.
    – ChrisFNZ
    Nov 11 '19 at 4:19
  • 1
    This might be a question for security.SE
    – Layman
    Nov 11 '19 at 4:35
  • 1
    I've considered posting this on Security.SE but this is mainly about handling relationships AFTER engagements, not security engagements. I think while it is a security profession specific problem but it's about relations outside but affected by the jobs.
    – John Zhau
    Nov 11 '19 at 4:40
  • 2
    I'm voting to close this question as off-topic because it seems like this will come down to policies of the company you're working for or terms of the agreement between your company and the client company (which may depend on whether penetration testing is still being performed at the company). Within the limits of those policies or terms, it will come down to how you want to engage with them. We may be able to help if you have something in mind to say, but you don't quite know how to say it.
    – Bernhard Barker
    Nov 11 '19 at 11:14
  • 1
    I have to agree with @Dukeling - anything to do with policy, needs to come from your company (and if it's only cultural norms, it needs a location and state that). Beyond that, the question specifically asks about the interaction outside work - in which you are under no real obligation to say anything truthful (and what you are actually allowed to say, is again, defined by your specific contract). Which is also frustrating, as this is a really interesting question.
    – user81330
    Nov 11 '19 at 12:21
7

To be honest, I'd look at it as an opportunity.

"Actually, I'm not with Cisco - I'm a security tester. You know how burglars sometimes dress in maintenance overalls so they won't arouse suspicion from neighbors? We sometimes have to do that as well so people won't wonder why we're wandering around an office building."

There are two things you're shooting for:

  1. Leaving the employee with something to think about. That's the opportunity: giving them a way to think about security going forward - to give them a nugget of education to take and use going forward. Maybe next time, they'll see someone wearing a 'Thompson Electronics Services' polo but notice they don't actually have a Visitor's Badge and make a call to security to make sure they're on the up-and-up.

  2. Being very careful to not phrase it in a way indicating the employee 'failed'. That's the tough part - it'd be very easy to hint that the employee failed, which could sour the interaction. Instead, obliquely reference what you were doing, not in reference to them, but to your job in general.

Improve this answer
3
  • 1
    To make sure, are you a professional PenTester/Red Teamer?
    – John Zhau
    Nov 11 '19 at 8:34
  • 4
    @JohnZhau Does it matter? You have asked for advice about relationships within the workplace, which is exactly what this answer is about. The answer doesn't become any less valid if Kevin doesn't work in Pen Testing. In fact, some would suggest seeing things from the "other side" is what's more important.
    – Gregory Currie
    Nov 11 '19 at 12:53
  • 1
    I'm not a professional PenTester. I've done a little of it at work before, and I often Pen Test my own works (plus I love learning about the subject) - but it's not my primary focus by any means. That said: the question isn't actually about Pen Testing - it's about how to interact with people you've 'conned' during a prior Pen Test.
    – Kevin
    Nov 11 '19 at 14:24

Not the answer you're looking for? Browse other questions tagged .