How to Conduct Vishing Test Exercises

Challenges of Vishing Awareness Training 

• Low volume/high impact: Vishing typically represents a very small percentage of overall phishing attacks against a company. However, when successful, vishing can provide the adversary with a foothold inside the network, where lateral movement and privilege escalation can lead to serious consequences. 
• Difficult to automate: Unlike automated email messages, most successful vishing attacks require human interaction and conversation, which makes it difficult for security teams to create and conduct repeatable tests. 
• Not recorded or scripted: As a result, voice calls limit our ability to analyze and learn. Training must be more general on the techniques, as opposed to having the ability to decompose a phishing email and clearly point out the clues for it being an attack. 

Creating an Effective Anti-Vishing Program 

1. Reconnaissance: Consider both external (or “black box”) and internal vishing. For external, determine what information gathering can be done by someone with little to no knowledge of the company. Social media platforms and corporate websites are excellent sources of information that can contribute to a realistic vishing exercise. Vishing can also occur from inside the company by someone who wants to access something they do not have permissions for. Intranet sites, org charts and even email can be sources of information for internal vishing attacks. 
2. Scenario development: While a vishing attack cannot be entirely scripted, it is important to write up the scenario, including the “payload” that provides the desired access or information. Some common payloads include: 
   • A website that captures login information: Here, the adversary asks the victim to navigate to a website and enter their credentials or other data, which is then captured and used to gain further access within the corporate network. 
   • Voice scripts: These are used to trick the victim into providing login information or data over the phone. The notorious IRS phone scams are a good example of this. 
   These scenarios depend heavily on the information gathering performed in the reconnaissance step. Here, the team must also determine which departments or employees will be targeted for the exercise. Execution can be time-intensive because unlike a single email that can be sent to thousands of accounts at once, a vish is best executed by a person speaking to the intended target. Consider this when developing target numbers. The team must also plan out which phones and phone numbers will be used to make the calls. Understanding the phone system the intended target uses is important because it can help you know whether your vish will show up as potential spam on the caller ID. Many cybersecurity training and penetration-testing organizations offer vishing services and can help you navigate more in-depth approaches for your environment and infrastructure. 
3. Execution: This step entails actually making the phone calls and logging the information gathered from them. In some locations, it may be legal to record the calls, but your team should always work with legal and human resources to determine if there are laws or corporate policies providing direction. This step may also include providing some immediate feedback to users, who may need to change passwords that are compromised, or addressing critical gaps in policy or process that leave the company at risk. 
4. Post-exercises: After your vishing exercises end, it is important to analyze results and put together a report, including recommendations on next steps. In most cases, this will also include updates to training or even supplementary training for some roles/users. 

Do’s and Don’ts for Effective Vishing Exercises 

• DO be aware of time constraints and deadlines within the business: You don’t want to derail the product team right before a major release or hit the finance team during an audit. While we all know adversaries do not care about timelines, we need to trust that our internal teams are being respectful. 
• DON’T highlight failures: Instead, focus on increased reporting and encouraging secure behaviors. Employees will naturally want to fall into a group that is celebrated. 
• DO include senior executives and their assistants in the vishing exercises: These roles are major targets for an adversary and must be just as aware of these tactics as others in the company. 
• DON’T use personal phone numbers that you cannot find on social media or with a quick public search. Always honor the privacy of your employees. 
• DO provide training in advance of any vishing exercises: As with all awareness training, your goal is not to “catch” or “fool” anyone, but rather to reinforce best practices to keep the company and employees safe. 
• DON’T be one size fits all: Tailor follow-up training to the role. If the recruiting team showed signs of needing training, discuss common tactics and techniques that an adversary will use against recruiting teams. People are much more likely to listen and learn when the information is tailored. 
• DO continuously train with anti-vishing programs set up in phases: Perhaps the first phase targets 10% of the company, then the second phase targets another 10%. This lets you exercise as much of the company as possible, while ensuring time for feedback in between. 
• DON’T forget to talk to competitors in your vertical: Find out what they are doing. Information sharing is a fantastic way to gain situational awareness that will improve your company’s security posture. 

READ MORE: Best Practices for Business Vishing Attack Prevention and Response

Protect Your Business Against Vishing Attacks 

• The anti-vishing program process: Creating effective anti-vishing programs includes multiple steps, from reconnaissance to lessons learned and reporting. Each must be allocated enough time and resources. 
• Vishing exercise best practices: Keep the event positive by being respectful of team deadlines and activities, reinforcing positive results (i.e., what percentage of people report a vish), and tailoring training to individual departments/roles. 
• Continuous training: Build the company’s muscle memory through a continuous cycle of vishing education, training, exercising and reporting.