Framework mapping
MITRE ATT&CK® Enterprise mapping
Tactics: Stealth
Relationship: exact BMC concept coverage
Open the official ATT&CK object ↗Exact concept-title or alias match reviewed during the v0.2.5 catalog reconciliation.
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Bare Metal Cyber is not affiliated with or endorsed by MITRE.
What it means
Techniques can occur through email, phone calls, in-person contact, support channels, social media, or physical access attempts. The attacker often combines plausible context with pressure that discourages verification.
Why it matters
Technical controls cannot replace processes that help people pause, verify, and report unusual requests.
Practical focus
- Teach verification for sensitive requests
- Limit information that helps attackers build convincing stories
- Use call-back and dual-approval procedures
- Practice reporting without blame
Common mistakes
- Assuming only inexperienced users are vulnerable
- Publishing detailed staff and process information unnecessarily
- Rewarding speed when a request should be verified
BMC v0.2.2 cornerstone expansion
Start analysis of Social Engineering with the mission or business outcome, then identify assets, identities, data, trust boundaries, dependencies, expected behavior, and credible failure or abuse cases.
Translate those observations into preventive, detective, responsive, and recovery controls. A mature explanation states not only what the concept is, but also how a practitioner demonstrates that it is working under normal, abnormal, and recovery conditions.
Evidence of effective implementation
- Documented ownership, scope, decision criteria, and permitted exceptions.
- Configuration or architectural evidence tied to a clear control objective.
- Operational telemetry showing expected and unexpected behavior.
- Testing that covers normal use, abuse cases, failure, rollback, and recovery.
- Exceptions that are approved, time bounded, monitored, and revisited.
- Lessons learned that result in updated designs, procedures, detections, or training.
Questions for learners
- Which security properties and business outcomes does Social Engineering support?
- What assumptions must remain true for the control or process to work safely?
- What could an attacker, insider, failure, or design error do at each trust boundary?
- Which evidence would prove that controls work continuously rather than only on paper?
- How would the organization respond, restore service, and re-establish trust after failure?
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: