Onsite Social Engineering Methodology 
During the engagement, the security analyst attempted to gain unauthorized entry to secure areas of People First FCU offices and network equipment. Posing as an employee of a large telecom provider, with badges easily created with basic office tools, the analyst attempted admittance. Prepared for potential questions the analyst was ready to explain the he was there as a contractor for technical system upgrades. 

The analyst easily gained entrance into the building and was able to confiscate a 'Visitor' badge. The ruse, including an imitation telecommunications vendor badge, coupled with the People First FCU Visitor badge, elicited credibility for the analyst. This credibility was leveraged to infiltrate the organization's multiple financial branches in the region. Preying upon the inherent human 'trust' factor, at many of the locations, the analyst was greeted warmly and escorted to secure communication areas, then left alone to complete his tasks. 

In one scenario, however, a suspicious employee followed company policy only to be misled with incorrect internal authentication: 

"Our normal procedure is for the branches to receive a call or an email providing advance notice when a contracted technician may be coming onsite. I hadn't received notification prior to the telecommunications imposter approaching me. I reached out to our IT team to confirm his legitimacy, and when I confirmed he had a People First visitor's badge, I was given the approval to allow the man to conduct his work. I led him to the back room and left him there to complete his tasks." 

- L. S., Branch Manger