In this workshop, we are taking a “defense through offense” approach to illuminating the principles and techniques adversaries use to trick humans into helping them achieve their goals.
It’s 2025, and social engineering attacks are as common as ever before. As organizations continue to lock down their technical controls, attackers must look for new avenues of least resistance to exploit. Often this can be as simple as asking for a password reset.
In this workshop, we are taking a “defense through offense” approach to illuminating the principles and techniques adversaries use to trick humans into helping them achieve their goals. By thinking like the attackers, we can be better prepared to recognize these situations and respond appropriately.
This workshop goes beyond the “what” of social engineering attacks and dives deep into the how and why they work. While this set of skills can be used maliciously, it can also be applied to make you a more attentive conversationalist and have more meaningful interactions with others.
After all, InfoSec is about people, not computers.
Syllabus
Social Engineering Introduction
How do we define SE
What role does it play in modern compromises
What traits make someone a successful social engineer
OSINT for social engineering
What information is most useful to a social engineer
Where is this information found
Discuss why such information cannot be used by defenders for security mechanisms
Breakdown of the tactics of influence
Taking control of the narrative
Examples of the tactics in use
Creation of pretexts
How to use stereotypes and environmental factors to our advantage
What can make or break a ruse
Applying the principles of influence to your chosen pretext
De-escalation Tactics
Discuss how to handle people who are scared or angry
Recognize when a situation is going wrong
Defensive Notes
Minimizing opportunities for social engineering via policies and culture
Maintaining relationships pre/post engagement when you’re the bad guy
● This course is open to attackers, defenders, pharmacists, baristas, and anyone else interested in exploring interactions between human psychology and information security.
● Prerequisites include an open-mind and a positive attitude.
Cameron Cartier is a security consultant at Black Hills Information Security. She holds a master’s degree in computer science from the University of Utah where she studied Tor and other privacy-enhancing technologies. In her role at BHIS, Cameron specializes in social engineering, physical security testing, and web application exploitation. Outside of work, Cameron is an amateur cage fighter and rock climber.