Social Engineering Simulation Workflow Appliance

• US 20160234245A1
• Filed: 02/04/2016
• Published: 08/11/2016
• Est. Priority Date: 02/05/2015
• Status: Active Grant

• Current Assignee: Barracuda Networks Incorporated
• Original Assignee: Phishline, LLC (Barracuda Networks Incorporated)
• Inventors: Chapman, Mark T.
• Granted Patent: US 9,699,207 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system for evaluating the susceptibility of an organization to social engineering, the organization having a plurality of sources and a plurality of members using electronic devices, is provided. The system includes an appliance in communication with the plurality of sources configured to retrieve contact information of members and to detect triggering events from the plurality of sources. The system includes a platform remote from the appliance configured to receive signals from the appliance indicative of the triggering events and to prepare and send communications, including templates based on each of the triggering events to the appliance. Upon receipt of the communications, the appliance is configured to retrieve the contact information of intended recipient members, to create messages based on the templates, and to send the messages to the intended recipient members. The platform does not receive the contact information of the plurality of members from the appliance.

Claims

1. A system for evaluating the susceptibility of an organization to social engineering, the organization having a plurality of sources and a plurality of members using electronic devices, the system comprising:

an appliance in communication with the plurality of sources, the appliance being configured to receive contact information of the plurality of members from at least one of the sources and to detect triggering events from the plurality of sources; and

a platform remote from the appliance and configured to receive signals from the appliance indicative of the detected triggering events, to prepare communications including templates based on each of the triggering events, and to send the communications to the appliance;

wherein upon receipt of the communications, the appliance is configured to retrieve the contact information of intended recipient members, to create messages based on the templates, and to send the messages to the intended recipient members.

2. The system of claim 1, wherein the platform does not receive the contact information of the plurality of members from the appliance

3. The system of claim 1, wherein the platform is configured to compile information regarding triggering events and to evaluate susceptibility of the organization to social engineering based on the triggering events.

4. The system of claim 1, wherein the sources include a plurality of databases and a messaging system.

5. The system of claim 1, wherein the appliance is configured to include personal information of the intended recipient members in the messages.

6. The system of claim 1, wherein the messages sent by the appliance to the intended recipient members solicit the intended recipient members to take an action.

7. The system of claim 6, wherein the action solicited by the message is one of clicking a link, providing confidential information, and downloading a file.

8. The system of claim 6, wherein the platform is configured to monitor whether the intended recipient member takes the action solicited by the message.

9. The system of claim 1, wherein the appliance is configured to periodically determine from at least one of the plurality of sources whether any of the contact information has been updated or new contact information has been added.

10. The system of claim 1, wherein the appliance is configured to only make outgoing connections with the platform.

11. The system of claim 1, wherein the appliance is configured to act as a specialized SMTP server and to personalize the messages based on tags included in the templates.

12. The system of claim 1, wherein the appliance is an SMTP client of one of a built-in, organization-hosted, or externally hosted SMTP server.

13. The system of claim 1, further comprising a secure SMTP server hosted external from the organization and separate from the platform.

14. The system of claim 13, wherein the secure SMTP server is hosted by a second organization different from the organization and wherein all messages and logs are periodically deleted from the secure SMTP server.

15. The system of claim 1, wherein the message includes a link to a landing page and wherein the appliance includes a landing page server configured to serve the landing page.

16. The system of claim 15, wherein the landing page solicits a visitor to enter information and wherein the appliance is configured to gather the information independent of the platform.

17. The system of claim 1, wherein the message includes a link to a landing page and wherein the server serving the landing page is independent from the platform.

18. The system of claim 1, wherein the message includes a link to a landing page hosted by the platform, and wherein the platform is configured to be periodically reset to remove information regarding intended recipient members that click the link.

19. The system of claim 1, wherein the messages solicit an e-mail response from the intended recipient members, the e-mail response being configured to be delivered by an SMTP server inaccessible by the platform, wherein the appliance is configured to review the e-mail responses from the intended recipient members, alias the messages to remove identifying information, and forward the aliased messages to the platform.

20. The system of claim 19, wherein the aliasing is performed using a seeded or unseeded cryptographic hash function.

21. The system of claim 1, wherein the contact information includes a telephone number and wherein the appliance is configured to replace the telephone number with a telephone identifier, send the telephone identifier to the platform, and upon receipt of the communications from the platform, the appliance is configured to create customized messages for each intended recipient member based on the templates and to dial the telephone number of the intended recipient member for each of the messages.

22. A method of reducing organizational susceptibility to social engineering, the organization having a plurality of sources, the method comprising:

receiving contact information for a plurality of members of the organization;

monitoring each of the sources for triggering events;

identifying at least one member of the organization as an intended recipient based on a detected triggering event;

preparing a message to the intended recipient based on characteristics of the detected triggering event, the message soliciting an action by the intended recipient;

transmitting the message to the intended recipient;

determining whether the intended recipient acts as solicited by the message; and

evaluating the action of the intended recipient.

23. The method of claim 22, wherein the sources include at least one directory, at least one database, and at least one messaging system.

24. The method of claim 22, wherein contact information includes an e-mail address book including e-mail addresses for members of the organization, the method further including periodically determining from at least one of the sources whether the e-mail address book for the members of the organization has been updated.

25. The method of claim 22, wherein contact information includes at least one of telephone numbers for members of the organization for voice phishing testing, mobile phone numbers by which SMS texting messages may be transmitted to members of the organization, and social media identifiers for members of the organization.

26. A system for evaluating the susceptibility to social engineering of an organization having a directory, a plurality of databases, and a messaging system, the system comprising:

an appliance configured to receive an address book having contact information for members of the organization from the directory and to connect to the plurality of databases and the messaging system, the appliance being configured to monitor the plurality of databases and the messaging system for triggering events; and

a platform configured to receive signals from the appliance indicative of triggering events identified by the appliance, to create templates based on the signals, and to send the templates to the appliance;

wherein the appliance is configured to create messages to intended recipients based on the templates;

wherein the platform is configured to determine whether the intended recipients take a predetermined action in response to the messages; and

wherein the platform is configured to compile statistics regarding the triggering events, messages, and intended recipients'"'"' actions in response to the messages.

27. The system of claim 26, wherein the appliance is configured to be inside a firewall of the organization and wherein the platform is configured to be outside the firewall of the organization.

28. The system of claim 26, wherein the platform is configured to create different templates for triggering events having different characteristics.

29. The system of claim 26, wherein the platform is configured to include a tag in at least one of the templates, and wherein the appliance is configured to add information into each of the messages regarding the intended recipient of the message based on the tag.

30. The system of claim 26, wherein the platform is configured to analyze susceptibility to social engineering of the organization over a time period and to send the analysis to the appliance and wherein the appliance is configured to incorporate information regarding the identity of members of the organization into the analysis.

31. The system of claim 26, wherein the appliance is configured to forward the messages to the intended recipients through an e-mail server of the organization.

32. A system for evaluating the susceptibility of an organization to social engineering, the organization having a plurality of sources and a plurality of members using electronic devices, the system comprising:

an appliance configured to receive an address book from at least one of the sources including identifying information and contact information regarding each of the plurality of members of the organization, the appliance being configured to alias at least some of the identifying information and to replace the contact information with identifiers to create an aliased address book, the information to be aliased being determined based on a predetermined algorithm;

a platform configured to receive the aliased address book from the appliance;

wherein the appliance is configured to detect a triggering event from the sources and to transmit an indication of the triggering event to the platform;

wherein the platform is configured to provide a communication to the appliance including a message template based on the triggering event, an indication of a delivery mode, a delivery identifier known by the appliance to map to one of the members of the organization, and scheduling instructions;

wherein the appliance is configured to create a personalized message based on the template for each of the intended recipients from information in the address book;

wherein the appliance is configured to send the messages to one of a plurality of servers separate from the platform based on the type of the message, the one of the servers being configured to send the messages to the intended recipients;

wherein the appliance is configured to monitor responses to the messages from the intended recipients; and

wherein the appliance is configured to alias portions of the responses, leave other portions of the responses un-aliased, and to profile portions of the responses based on a predetermined algorithm and to send the aliased, un-aliased, and profiled portions of the responses to the platform.

33. The system of claim 32, wherein the servers include a telephony server, a text message server, and an e-mail server.

34. The system of claim 32, wherein the appliance acts as the plurality of servers.