The Art of Deception_ Controlling the Human Element of Security - Kevin D. Mitnick [174]
I thank my parents Marjorie and I. B. Simon, who I wish were here on earth to enjoy my success as a writer. I also thank my daughter, Victoria. When I am with her I realize how much I admire, respect, and take pride in who she is.
index
A
access
changing global rights
lockout
necessity of control
terminating employee.
wireless access points
account
authorization of new
disabling
expiration
guest
privileged
temporary
Advanced Research Projects Agency Network (ARPANet)
airports, security at
ANI (automatic number identification)
antivirus software
keeping current
policies regarding.
spyware and
appearance, judging by
ARPANet (Advanced Research Projects Agency Network)
attack
brute force
dictionary
direct
identity theft
incidence of
attack, social engineering
credit card numbers, obtaining
customer information. obtaining
cycle of
from employees
by employment agency
on entry-level employee
on financial institutions
identification of.
Internet scam case studies
law enforcement procedures, learning about
methods, common
new employee as target of
success rate of
targets, common
unlisted phone numbers, obtaining.
vulnerability to
warning signs of
auditing
erasing trail
log.
authentication
devices, necessity of
for remote access
of software
two-factor
authority
challenging
tendency to comply with
using for intimidation
authorization, procedures
automatic number identification (ANI)
awareness program. See also training
B
backdoors
background checks
backup media.
badge
design
electronic ID.
policy on
recovery from departing employee
security
temporary
visitor
banks
accessing information from.
internal security code use
black bag job
bribes
brute force attack
bulletin board, company
business cards, phony
C
cable and pair number
callback
call blocking
caller ID,
callers, verification of
call forwarding
call trace feature
candy security
cell phone case study
charts, organizational
checks, bounced
class-action suit case study
Cleaner, The
cleaning crews, security training of
clearlogs program
CNA (Customer Name and Address) bureau
codes, security
college records, as target
command shell, remote access to
computer administration policies
computer operations policies
confidence (con) man
Confidential data classification.
consistency
console terminal
contractor, accounts for
corporate directory, as target of social engineers
cost center number
courtesy phones
cracking tools
credibility, gaining
credit card numbers
CreditChex case study
criminal history record
Customer Name and Address (CNA) bureau
customers
information on, obtaining.
protecting
D
data classification
Confidential
Internal
policy
Private
Public
terminology
dead drop
deception
social engineering use of
terrorists and
trust as key to
defense in depth
deleting files
deniability, plausible
deny terminate telephone service
Department of Motor Vehicles (DMV), obtaining information from
detention center case study
dictionary attack
digital certificate, Web site
direct connect telephone service
directory
company directory as target
on-line
Test Number Directory
DMV (Department of Motor Vehicles), obtaining information from
drivers license
dual-homed host
dumb terminal
dumpsterdiving
E
eavesdropping, on radio frequencies
eBay
e-commerce
address, disclosure of
attachment
dead drop
digitally signed
drops in foreign country
generic addresses
links in
usage policy
employee
admitting an off-site
attacks from current or former
background checks
departing, procedures for
disgruntled
entry-level, attacks on
new employee as attack target
private information