Social Engineering in a Pen Test: What to Allow and What to Rule Out

AWS's penetration testing page says simulated phishing needs a Simulated Events form, and that all such requests must be submitted at least two weeks before the start date. Microsoft's rules of engagement go further and prohibit phishing or social engineering of Microsoft employees, or carried out through Microsoft services. Social engineering is a separate piece of work with separate approvals, not a line you add to a web app test.

What's affected

Any test that adds phishing, phone calls, messaging or physical pretexting. NIST SP 800-115 describes social engineering as a way to test the human element and user awareness, with analog forms (conversation, phone) and digital ones (email, instant messaging).

What to do now

1. Decide whether you need it at all. If the customer asked for a web or API test, they probably did not ask for phishing. Check the questionnaire wording.
2. Name the channels. Email, phone, SMS, chat, in person. Exclude the ones you do not want.
3. Name the targets. NIST notes that targeting specific individuals can embarrass them, and that results should improve the organization, not single out people. Report by group, not by name.
4. Tell a small group. Your CEO or security lead and one HR contact should know. Ordinary staff do not, or the test is meaningless.
5. Agree stop rules. If an employee reports it, how do you tell the report was a test and close it? If a real credential is entered, who resets it and when?
6. Sort out providers. If the lure uses your cloud mail or hosting, check the provider rules. Use the AWS Simulated Events form two weeks ahead where it applies. Do not phish through services whose rules forbid it.
7. Ask for a report on what failed and what worked. NIST asks for detail on both successful and unsuccessful tactics, so training can be tailored.

How to avoid this trap

• Never use real customer or vendor staff as targets.
• Keep the payload harmless: a tracking page, not malware.
• Tie the result to training, not discipline.

Quick check

Sources

• AWS: Penetration Testing
• Microsoft Security Testing Rules of Engagement
• NIST SP 800-115, section 5.3 Social Engineering