CSEPS

CSEPS (the Certified Social Engineering Prevention Specialist program) is a corporate security-awareness training and certification course developed in 2003 by Kevin Mitnick and Alex Kasper through their consultancy, Defensive Thinking.¹ It is their belief it is the first professional certification built specifically around defending against social engineering, rather than technical intrusion.²

Course Structure

CSEPS was delivered as a two-day, in-person “boot camp” costing roughly $1,500 per attendee, combining lecture, case studies, live attack demonstrations, and pretexting exercises. Clients included corporations, government agencies, and military organizations, among them the U.S. Air Force and Marine Corps. The certification exam itself combined multiple-choice and written-response questions on social-engineering defense and mitigation.²

The curriculum was organized into a series of print training-workbook modules. The first covered the fundamentals of social engineering: what it is, why it works, who social engineers target, and the research/develop-trust/exploit-trust attack cycle.³ The second turned to planning an attack: intelligence gathering, researching a company and its personnel, dumpster diving, and elicitation techniques for drawing out information indirectly.⁴ The third covered pretexting and execution: building a false identity, establishing rapport and credibility, and the psychological principles of influence, persuasion, and compliance that make those pretexts work.⁵ Later modules addressed building resistance to manipulation and turning an organization’s employees into what the course called a “human firewall.”

History

Mitnick and Kasper partnered with Intense School Inc., a Florida-based IT training company, in 2003 to deliver CSEPS classes in the United States ² and later worldwide. Coverage of the program and its instructors followed over the next two years, including a 2005 Wired profile of Kasper and Mitnick’s shared history⁶ and a 2005 ZDNet report on a CSEPS-style workshop in Sydney describing the goal of building a “human firewall” against social engineers.⁷

In 2012, Mitnick partnered with the security-awareness training company KnowBe4 as its Chief Hacking Officer,⁸ a role he held for the rest of his career. By the time of a 2020 Fast Company profile, hiring a reformed hacker to test and train employees against social engineering, the approach CSEPS had pioneered nearly two decades earlier, had become mainstream corporate practice.⁹

Related Articles

References