The most recent discussions that have sparked my interest have been those around what is or in many cases isn’t considered to be accurate or real simulated testing.

Like others I have my opinion on what this means to me and I don’t want to go into all the details of my opinions, approaches or theories here, but I wanted to make a couple of observations that I think are primary to the boundaries that exist in the world of simulated testing. I am not focusing on any specific part of simulated testing, but obviously in the context of things here I gravitate to the human elements associated with social engineering.

So here are my two main points. Point one, no simulated testing is every going to fully replicate the real adversary as if it does then now your the criminal also, point two a very select few outside of the real adversarial groups / gangs really know with suitable detail the TTPs used to allow full replication in a simulated scene.

No doubt some of you just spat your drink, cursed at the screen and crossed me off your christmas card list, but let me briefly clarify my thinking. The one thing that should separate a simulated vs real adversary should be their ethical boundaries they constrain themselves with. This should balance pushing the boundaries to their limit to replicate the real activities, but with strained to the point you are an employee or service provider to an organisation, and as a result their are lines that shouldn’t be crossed, as the personal damage could be substantial. A simple example could be that the real adversary sends emails and makes phones calls to the CEO of the company, making threats about family members to influence decision making, sure you could do this in a simulated environment, but then when its communicated it wasn’t for real, it was to test how people handle an adversary the damage is already done, the emotional turmoil has occurred and cannot be undone. The second point I make is that, no matter how good an intelligence function maybe, or whats read in the media the information is typically based on whats been discovered to date, hear say or some other theory. The reality is aside from the adversary themselves no one knows the full extent of their tools, tactics and procedures, so this is why I don’t believe anyone can claim to fully simulate anything, instead its more pragmatic to utilise the information, tools, techniques to push the boundaries to suitable levels within the ethical levels acceptable to the individuals conducting the work and those who are on the receiving end and or approved to authorise them.

Like everyone else on the Internet this is just my opinion, I don’t think there is one size fits all, and some approaches and appetites may deliver more value than others, but without ethics and without boundaries things become a darker shade of grey.

The post Ethical Boundaries of Simulated Testing appeared first on Social Engineering Blogs.

The post Wound Collectors appeared first on Social Engineering Blogs.

The post Christopher Dorner’s Toxic Manifesto appeared first on Social Engineering Blogs.

The post What to Make of the Woody Allen Case? appeared first on Social Engineering Blogs.

The post Why Predators Are Attracted to Careers in the Clergy appeared first on Social Engineering Blogs.

The post Psychopathy and Mass Movements appeared first on Social Engineering Blogs.

I have never considered this before but Reciprocity is really the principle of life.  It allows people to build relationships, for businesses to thrive, and for communities to prosper.

We also know that Reciprocity is triggered by the giving of gifts.  But the question is…

“Are all gifts the same?”

Take the following example,

Peter works at a family owned business and really enjoys the extra perks the business provides.  Lunch is available daily as is a fully stocked snack and beverage refrigerator which can be accessed at any time.

If Peter perceives that the extra perks are only provided so he doesn’t leave his desk, meaning he can work longer hours and is continually reminded what the business does for him – this is a bribe.

If the perks are looked upon as something that has always been provided and is a right of everyone who works at the business – this is an entitlement.

If the perks are only topped up at the end of each month if the team hits their numbers – this is a reward.

If the perks are given with no expectation of return and are provided because the office recognises it is not that close to convenience or grocery stores – this is a gift.

Therefore the nature to which something triggers Reciprocity is linked to the intent with which it is given but also the perception of the intent by the recipient.

If something is seen as a gift this is likely to trigger the obligation and in the above case Peter is more likely to work harder and cut the business some slack if there is a lack of support for things he wants done because what they have done for him.

If the action is seen as a reward, Peter may work harder to keep his benefits, but if he knows that due to the activities of others he won’t get the reward this month, will he stop trying?

If the perks are given by way of bribe this is problematic because the business is simply buying loyalty and compliance and in harder financial times this may be harder to maintain hence performance may become very irregular.  However the bribe may have deeper implications.  If Peter perceives that the perks are a bribe and this is an appropriate tactic to get things done within the business, recent research suggests this may impact at a deeper level, that of the acceptance of unethical culture within the business. Therefore Peter may bribe his suppliers, other staff, etc. because “that’s how it is done around here”.  So be very careful about how your efforts are perceived.

Finally if you want to see if Peter sees the perks as an entitlement – just take it away and see what happens.  If Peter and his colleagues get angry they are seeing the perks as something they are “entitled to’ and therefore will not reciprocate because it is a right of working at the business.

Therefore when giving to staff or others, be clear about your intent for giving.  If you have free water in a waiting area don’t put the refrigerator in clear view where people can just help themselves.  Have the water behind the counter and as people come into the business, make reference to it being a warm day outside and offer them a cool drink.  This is a gift.  You went first and it is customised to the customer based on environmental conditions.  If the water is in the waiting area it may be seen as an entitlement or a right in doing business with you.

Show your work.  Let people know you are thinking about them and are providing the gift as a result of their situation.  Although do not  labour the point and make them feel guilty for receiving it.  Give with no expectation of return and watch your relationship build as a result.

In case above, Peter realises the family business provides the lunch, snacks and beverages for the workers because times are tough and getting time to make a healthy lunch while juggling family, commute times, etc. was hard.  Most employees were spending money on fast food but they were losing time out of their lunch break because they had to travel to get something.  So when they got back they were often stressed and their diet was not helping them.  To mix it up the business changes the menu regularly and have a theme for each month telling staff they want to help them have a healthy and happy time at work.

To show their clear intent the sign in the meal room says “That’s what family do for one and other – here’s to another great day”.

The post Reciprocity and Giving appeared first on Social Influence Consulting Group.

The post Reciprocity and Giving appeared first on Social Engineering Blogs.

** To vote for Robert Cialdini, President of Influence At Work, for the Top Management Thinker of 2013

The post Aligning the Principles of Influence with Aristotle’s Ethos, Pathos and Logos appeared first on Social Engineering Blogs.