Are You and Your Organization Vulnerable to Social Engineering?

by Joanna Pineda Posted on October 27, 2010

A couple of years ago, I discovered strangers walking through our office unescorted.  They told our receptionist that they were looking at office space in the building; they were well dressed, the referenced the name of our landlord and they asked nicely if they could just walk around and take a look at our space.  Our receptionist, ever on the lookout for ways to be helpful, let them wander the halls.

A couple of months ago, someone claiming to be an exhibitor at a client’s trade show called, asking for the client’s logo so they could use it in an e-mailing going out.  The person said they had the approval of the client.  My responsive Project Manager opened up a work request and got the logo sent out asap.

In both cases, the persons making the requests were legitimate and no harm was done.  BUT, they just as easily could have been hackers or scammers and my helpful staff could have been duped into giving them information or access they were not authorized to have.  Which is why Matrix Group covers security during orientation and training for all new hires and we recently brought in a security expert to discuss social engineering.

Social engineering is “the act of manipulating people into performing actions or divulging confidential information, rather than by breaking in or using technical cracking techniques.” Kevin Mitick, the famous computer hacker, claims that it’s “much easier to trick someone into giving a password for a system than to spend the effort to crack into the system.”  There are many social engineering techniques, including:

Social engineering is highly successful because of the natural human tendency to trust other people. In addition, most people want to be helpful.  In fact, we train our staff to be helpful because helpfulness is key to a successful business.  If you’re wondering if you or your organization are vulnerable to social engineering tactics, ask yourself these questions:

Okay, now that you’re paranoid, what are you going to do about this potential threat to you and your organization?

4 replies on “Are You and Your Organization Vulnerable to Social Engineering?”

Since my company has such high-profile clients, we get a lot of scammers calling for info -“(Client) told me to call.” – and we are extremely skeptical. We’re polite, (attempt to) take the callers info and always check with the clients before divulging anything or allowing use of name, likeness, etc. It’s scary how prevalent this is. Separately, I recently lost a flash drive with a lot of documents on it (none confidential, thankfully) and I hope whoever finds it thinks I was baiting and it just gets thrown out!

You mention the natural human tendency to trust other people. It also works the other way.

If I’m in the office very early, before the receptionist, and someone arrives for a very early meeting, I will request that they remain in the elevator lobby so that I can verify that the person they have an appointment to meet is indeed present and expecting them. In all of the (very few) cases where this has occurred, the visitors have always been extremely willing to cooperate and have always been understanding about the security issue.

Only once was I unable to verify the visit, and in that case, I explained that I had two options. One was to escort the visitor on my own time until the person they were waiting for arrived, or to request that they return. Again, this visitor was extremely obliging and returned after the office opened.

I should think if such a visitor made a huge fuss, it would make me rather suspicious.

As a social engineer myself these are some tactics used very commonly amongst others. you will be surprised how often a phone call claiming to be a member of staff form the very same building the receptionist works in claiming you are expecting a visitor at such and such time and to please send them on up to their office when they arrive.
As a pentester the biggest security threat to most businesses are the staff.

Comments are closed.

Related Articles