Are You and Your Organization Vulnerable to Social Engineering?

A couple of years ago, I discovered strangers walking through our office unescorted.  They told our receptionist that they were looking at office space in the building; they were well dressed, the referenced the name of our landlord and they asked nicely if they could just walk around and take a look at our space.  Our receptionist, ever on the lookout for ways to be helpful, let them wander the halls.

A couple of months ago, someone claiming to be an exhibitor at a client’s trade show called, asking for the client’s logo so they could use it in an e-mailing going out.  The person said they had the approval of the client.  My responsive Project Manager opened up a work request and got the logo sent out asap.

In both cases, the persons making the requests were legitimate and no harm was done.  BUT, they just as easily could have been hackers or scammers and my helpful staff could have been duped into giving them information or access they were not authorized to have.  Which is why Matrix Group covers security during orientation and training for all new hires and we recently brought in a security expert to discuss social engineering.

Social engineering is “the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques.” Kevin Mitick, the famous computer hacker, claims that it’s “much easier to trick someone into giving a password for a system than to spend the effort to crack into the system.”  There are many social engineering techniques, including:

• Pretexting is the act of getting people to divulge small pieces of information, which hackers use to obtain more information from the next person.  Knowing bits of information establishes legitimacy in people’s minds and makes them more willing to divulge even more information.
• Phishing is used to fraudulently obtain private information.  Phishers typically impersonate legitimate businesses via phone or e-mail and convince victims to divulge sensitive or private information.  Think of the hundreds of e-mails you get that look like they’re from your bank; nearly all of them ask you for your account information, login information and/or SSN.
• Baiting is a technique whereby hackers leave CDs or USB sticks containing viruses or trojans in public places, in the hopes that a curious person will pick up the items and insert them into their systems, effectively infecting them and making them vulnerable to hacker attacks.

Social engineering is highly successful because of the natural human tendency to trust other people. In addition, most people want to be helpful.  In fact, we train our staff to be helpful because helpfulness is key to a successful business.  If you’re wondering if you or your organization are vulnerable to social engineering tactics, ask yourself these questions:

• How easy or hard would it be for someone to gain access to your office by mentioning the name of the CEO and some key staff?
• How difficult would it be for someone to impersonate you by providing your name, address, SSN, mother’s maiden name, spouse name, etc.  I’ll bet a lot of this information is on public Web sites and social networks.  Just look at some of your friends’ profiles on Facebook; you’ll find hometown, e-mail, birthday, the works!
• How hard would someone have to work to impersonate someone and convince a network admin to divulge or reset a password?
• Have you held the lobby door open for someone off the street while entering a secure building?

Okay, now that you’re paranoid, what are you going to do about this potential threat to you and your organization?

• 3 Comments
• Tags: privacy, security