25. A penetration tester, who did not have an access badge, managed to follow a group of employees through multiple badged-access doors and into the data center without being stopped. The tester mentions this finding during the after-action review with the Chief Information Security Officer (CISO). Which of the following issues should the CISO address as a result of this finding?
Answer: D
Social engineering
The CISO should address social engineering as a result of the penetration tester's finding. This incident illustrates how an individual without proper access credentials was able to gain unauthorized access by exploiting the trust and behavior of employees, which is a key aspect of social engineering.
A) Role-based access
While role-based access control is important for ensuring that individuals only have access to information necessary for their roles, this scenario does not directly demonstrate a failure in role-based access. The issue here is more about the manipulation of social interactions rather than the access controls assigned to roles.
B) Shoulder surfing
Shoulder surfing refers to the act of observing someone’s private information, typically through their screen or keyboard. This scenario does not involve observation of sensitive information but rather unauthorized access through physical means, making shoulder surfing irrelevant in this context.
C) Insider threat
An insider threat typically refers to individuals within an organization who misuse their access to harm the organization. In this case, the tester was not an insider but rather an external individual who exploited social dynamics to gain access. Therefore, this option does not accurately reflect the nature of the issue.
D) Social engineering
Social engineering is the manipulation of individuals into performing actions or divulging confidential information. In this case, the penetration tester used the opportunity of following employees to gain access, clearly highlighting a vulnerability in security awareness and employee training regarding unauthorized access.
Conclusion
The correct answer is social engineering, as it directly relates to the method the penetration tester employed to bypass security protocols. The other options, while relevant to security considerations, do not accurately capture the specific issue of unauthorized access due to social manipulation. Addressing social engineering is crucial for improving overall security awareness and preventing similar incidents in the future.