Social:Certified social engineering prevention specialist
Certified Social Engineering Prevention Specialist (CSEPS) is a social engineering security-awareness training and professional certification program originally developed by Kevin Mitnick and Alexis Kasperavičius.[1][2][3]
Course structure
The original CSEPS program was structured as a multi-module corporate security-awareness course designed to teach employees, managers, and IT personnel how social engineers manipulate human behavior to bypass technical security systems.[4]
The curriculum combined case studies, psychological analysis, attack demonstrations, pretexting exercises, and operational security scenarios.[5]
The course materials described social engineering as the exploitation of "the human factor" in information security and argued that traditional technical defenses alone were insufficient to protect organizations from deception-based attacks.[4]
The training program was divided into instructional modules covering topics such as:
- social engineering methodology and threat analysis
- intelligence gathering and reconnaissance
- dumpster diving
- pretexting
- elicitation technique
- telephone-system exploitation and caller-ID spoofing
- psychological influence techniques
- industrial espionage
- identity theft
- organizational vulnerabilities
- security policy development and employee awareness training[6][5][3]
The course also analyzed historical and contemporary case studies involving information theft, corporate espionage, fraudulent wire transfers, and telephone-based impersonation attacks.[4]
Training exercises required participants to analyze how attackers established credibility, manipulated trust, overcame objections, and exploited organizational procedures.[5]
According to The Wall Street Journal, CSEPS was delivered as a two-day "boot camp" course costing approximately US$1,500 per attendee.[1] Clients reportedly included the United States Air Force and the United States Marine Corps.[1]
The certification examination included multiple-choice and written-response sections dealing with social-engineering defense scenarios and mitigation strategies.[2]
History
In 2003, Mitnick and Kasperavičius partnered with the Florida-based IT training company Intense School Inc. to offer CSEPS classes throughout the United States.[1]
In 2020, Mitnick partnered with security-awareness training company KnowBe4, and elements of the original CSEPS material became incorporated into KnowBe4's social-engineering awareness training offerings.[7][8]
References
- ↑ 1.0 1.1 1.2 1.3 "Ex-Hacker Kevin Mitnick Teaches From Experience". The Wall Street Journal: p. B1. October 15, 2003. https://www.wsj.com/articles/SB106626190166097800.
- ↑ 2.0 2.1 Gray, Patrick (June 6, 2005). "A Tale of Two Hackers". Wired. http://www.wired.com/news/culture/0,1284,67521,00.html.
- ↑ 3.0 3.1 Kotadia, Munir (13 April 2005). "Human firewall a crucial defence". ZDNet (CBS Interactive). https://www.zdnet.com/article/human-firewall-a-crucial-defence-mitnick/.
- ↑ 4.0 4.1 4.2 CSEPS Training Workbook – Module 1: Understanding Social Engineering. Defensive Thinking, LLC. 2003. pp. 1–15.
- ↑ 5.0 5.1 5.2 CSEPS Training Workbook – Module 3: Pretexting and Execution. Defensive Thinking, LLC. 2003. pp. 1–16.
- ↑ CSEPS Training Workbook – Module 2: Planning the Attack. Defensive Thinking, LLC. 2003. pp. 1–14.
- ↑ "Kevin Mitnick Partners With KnowBe4" (Press release). PR Newswire. June 12, 2012.
- ↑ Sjouwerman, Stu (July 16, 2020). "I hired an infamous hacker—and it was the best decision I ever made". Fast Company. https://www.fastcompany.com/90528167/i-hired-an-infamous-hacker-and-it-was-the-best-decision-i-ever-made.
 |  |
