Social engineering simulation workflow appliance

• US 9,871,817 B2
• Filed: 06/01/2017
• Issued: 01/16/2018
• Est. Priority Date: 02/05/2015
• Status: Active Grant

• Current Assignee: Barracuda Networks Incorporated
• Original Assignee: Phishline, LLC (Barracuda Networks Incorporated)
• Inventors: Chapman, Mark T.
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US15/610,884
• Publication Number:
  US 20170264633A1
• Time in Patent Office: 229 Days
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

A system for evaluating the susceptibility of an organization to social engineering, the organization having a plurality of sources and a plurality of members using electronic devices, is provided. The system includes an appliance in communication with the plurality of sources configured to retrieve contact information of members and to detect triggering events from the plurality of sources. The system includes a platform remote from the appliance configured to receive signals from the appliance indicative of the triggering events and to prepare and send communications, including templates based on each of the triggering events to the appliance. Upon receipt of the communications, the appliance is configured to retrieve the contact information of intended recipient members, to create messages based on the templates, and to send the messages to the intended recipient members. The platform does not receive the contact information of the plurality of members from the appliance.

Claims

1. A method of reducing organizational susceptibility to social engineering, the organization having a plurality of sources, the method comprising:

receiving, via a computer appliance, contact information for a plurality of members of the organization;

monitoring, via the computer appliance, each of the sources for triggering events;

receiving, via a computer platform remote from the computer appliance, signals from the computer appliance indicative of detected triggering events and delivery identifiers associated with the detected triggering events, wherein the computer platform creates different templates for detected triggering events having different characteristics;

preparing, by the computer platform, communications including templates based on each of the detected triggering events, wherein the computer platform compiles information regarding detected triggering events and evaluates susceptibility of the organization to social engineering based on the detected triggering events, and wherein the computer platform does not receive the contact information of the plurality of members from the computer appliance;

transmitting, by the computer platform, the communications including the templates to the computer appliance;

including a tag in at least one of the templates on the computer platform;

identifying, via the computer appliance, at least one member of the organization as an intended recipient based on one of the detected triggering events;

preparing, by the computer appliance, a message to the intended recipient based on characteristics of the one of the detected triggering events, the message soliciting an action by the intended recipient;

adding, by the computer appliance, information into the message regarding the intended recipient of the message based on the tag;

transmitting the message, using the computer appliance, to the intended recipient;

determining, by the computer platform, whether the intended recipient acts as solicited by the message; and

evaluating, by the computer platform, the action of the intended recipient.

2. The method of claim 1, wherein the sources include at least one directory, at least one database, and at least one messaging system.

3. The method of claim 1, wherein the contact information includes an e-mail address book including e-mail addresses for members of the organization, the method further including periodically determining from at least one of the sources whether the e-mail address book for the members of the organization has been updated.

4. The method of claim 1, wherein the contact information includes at least one of telephone numbers for members of the organization for voice phishing testing, mobile phone numbers by which short message service (SMS) texting messages may be transmitted to members of the organization, and social media identifiers for members of the organization.

5. The method of claim 1, wherein the delivery identifiers do not provide information to the computer platform.

6. The method of claim 1, further including the steps of utilizing the computer appliance inside a firewall of the organization and utilizing the computer platform outside the firewall of the organization.

7. The method of claim 1, further including the steps of:

aliasing, by the computer appliance, at least some identifying information for the plurality of members;

replacing the contact information with identifiers to create an aliased address book; and

receiving the aliased address book via the computer platform.

8. The method of claim 1, further including the steps of:

monitoring, using the computer appliance, a response to the message from the intended recipient;

aliasing, via the computer appliance, portions of the response and leaving other portions of the response un-aliased;

profiling portions of the response based on a predetermined algorithm; and

sending the aliased, un-aliased, and profiled portions of the response to the computer platform.

9. The method of claim 1, further including the step of compiling, using the computer platform, statistics regarding one or more triggering events, one or more messages, and one or more actions taken in response to the one or more messages.