2KKUU7ita

Chapter 5: Social Engineering
request is made over the telephone, verify the caller’s identity and call
back.
✓ Never click an e-mail link that supposedly loads a page with information
that needs updating. This is especially true for unsolicited e-mails.
Mouse-over links can be just as dangerous as cross-site scripting, and
related exploits can be carried out by a user innocently placing his or
her mouse over a hyperlink. Mouse-over vulnerabilities can be handled
by antimalware software at the network perimeter or computer level as
well as within the application itself.
✓ Be careful when sharing personal information on social networking
sites, such as Facebook or LinkedIn. Also, be on the lookout for people
claiming to know you or wanting to be your friend. Their intentions
might be malicious.
✓ Escort all guests within a building.
✓ Never open e-mail attachments or other files from strangers.
✓ Never give out passwords.
A few other general suggestions can ward off social engineering:
✓ Never let a stranger connect to one of your network jacks or wireless
networks — even for a few seconds. A hacker can place a network
analyzer, Trojan-horse program, or other malware directly onto your
network.
✓ Classify your information assets, both hard copy and electronic. Train
all employees how to handle each asset type.
✓ Develop and enforce computer media and document destruction policies
that help ensure data is handled carefully and stays where it should
be. A good resource for information on destruction policies is www.
pdaconsulting.com/datadp.htm.
✓ Use cross-shredding paper shredders. Better still, hire a
document-shredding company that specializes in confidential document
destruction.
These techniques can reinforce the content of formal training:
✓ New employee orientation, training lunches, e-mails, and newsletters
✓ Social engineering survival brochure with tips and FAQs
✓ Trinkets, such as screen savers, mouse pads, sticky notes, pens, and
office posters that bear messages that reinforce security principles
The Appendix lists my favorite security awareness trinkets and tool vendors
to improve security awareness and education in your organization.
79