• Choose a category
• All
• Classic-Fiction

Stanley Rifkin had used the art of deception—the skills and techniques that are today called social engineering. Thorough planning and a good gift of gab is all it really took.

And that’s what this book is about—the techniques of social engineering (at which yours truly is proficient) and how to defend against their being used at your company.

THE NATURE OF THE THREAT

The Rifkin story makes perfectly clear how misleading our sense of security can be. Incidents like this—okay, maybe not $10 million heists, but harmful incidents nonetheless—are happening every day. You may be losing money right now, or somebody may be stealing new product plans, and you don’t even know it. If it hasn’t already happened to your company, it’s not a question of if it will happen, but when.

A Growing Concern

The Computer Security Institute, in its 2001 survey of computer crime, reported that 85 percent of responding organizations had detected computer security breaches in the preceding twelve months. That’s an astounding number: Only fifteen out of every hundred organizations responding were able to say that they had not had a security breach during the year. Equally astounding was the number of organizations that reported that they had experienced financial losses due to computer breaches: 64 percent. Well over half the organizations had suffered financially. In a single year.

My own experiences lead me to believe that the numbers in reports like this are somewhat inflated. I’m suspicious of the agenda of the people conducting the survey. But that’s not to say that the damage isn’t extensive; it is. Those who fail to plan for a security incident are planning for failure.

Commercial security products deployed in most companies are mainly aimed at providing protection against the amateur computer intruder, like the kids known as script kiddies. In fact, these wannabe hackers with downloaded software are mostly just a nuisance. The greater losses, the real threats, come from sophisticated attackers with well-defined targets who are motivated by financial gain. These people focus on one target at a time rather than, like the amateurs, trying to infiltrate as many systems as possible. While amateur computer intruders simply go for quantity, the professionals target information of quality and value.

Technologies like authentication devices (for proving identity), access control (for managing access to files and system resources), and intrusion detection systems (the electronic equivalent of burglar alarms) are necessary to a corporate security program. Yet it’s typical today for a company to spend more money on coffee than on deploying countermeasures to protect the organization against security attacks.

Just as the criminal mind cannot resist temptation, the hacker mind is driven to find ways around powerful security technology safeguards. And in many cases, they do that by targeting the people who use the technology.

Deceptive Practices

There’s a popular saying that a secure computer is one that’s turned off. Clever, but false: The pretexter simply talks someone into going into the office and turning that computer on. An adversary who wants your information can obtain it, usually in any one of several different ways. It’s just a matter of time, patience, personality, and persistence. That’s where the art of deception comes in.

To defeat security measures, an attacker, intruder, or social engineer must find a way to deceive a trusted user into revealing information, or trick an unsuspecting mark into providing him with access. When trusted employees are deceived, influenced, or manipulated into revealing sensitive information, or performing actions that create a security hole for the attacker to slip through, no technology in the world can protect a business. Just as cryptanalysts are sometimes able to reveal the plain text of a coded message by finding a weakness that lets them bypass the encryption technology, social engineers use deception practiced on your employees to bypass security