2KKUU7ita

Chapter 5: Social Engineering
Social engineers often know a little about a lot of things — both inside and
outside their target organizations — because this knowledge helps them in
their efforts. The more information social engineers gain about organizations,
the easier it is for them to pose as employees or other trusted insiders. Social
engineers’ knowledge and determination give them the upper hand over average
employees who don’t recognize the value of the information that social
engineers seek.
Understanding the Implications
Many organizations have enemies who want to cause trouble through social
engineering. These enemies might be current or former employees seeking
revenge, competitors wanting a leg up, or hackers trying to prove their skills.
Regardless of who causes the trouble, every organization is at risk — especially
with the web, which can help facilitate hacking and information gathering. Larger
companies spread across several locations are often more vulnerable given their
complexity, but smaller companies can also be attacked. Everyone, from receptionists
to security guards to IT personnel, is a potential victim of social engineering.
Help desk and call center employees are especially vulnerable because
they are trained to be helpful and forthcoming with information. Even the aver
age, untrained employee is susceptible to attack.
Social engineering has serious consequences. Because the objective of
social engineering is to coerce someone for information to lead to ill-gotten
gain, anything is possible. Effective social engineers can obtain the following
information:
✓ User or administrator passwords
✓ Security badges or keys to the building and even to the computer room
✓ Intellectual property such as design specifications, source code, or
other research and development documentation
✓ Confidential financial reports
✓ Private and confidential employee information
✓ Customer lists and sales prospects
If any of the preceding information is leaked, financial losses, lower employee
morale, decreased customer loyalty, and even legal and regulatory compliance
issues could result. The possibilities are endless.
Social engineering attacks are difficult to protect against for various reasons.
For one thing, they aren’t well documented. For another, social engineers are
limited only by their imaginations. Also, because so many possible methods
69