Download

406 Chapter 12 • Social EngineeringUsing reciprocation, a social engineer brings a problem to the target’s attention and thenoffers a solution (e.g.,“the badge reader on the door is being finicky today. I found thatholding my badge upside down works best.”) Once the social engineer has done this smallfavor, he or she will be comfortable asking for a favor.Using consistency, an attacker reminds an employee of the policies that they agreed tofollow as a condition of employment, and then asks the employee for his or her password tomake sure it complies with policies and practices.Using social validation, an attacker tells an employee that he or she is conducting theinformation-gathering phase of a new Information Technology (IT) project and says that heor she have already received input from other employees with a similar standing in the company.Subconsciously, the employee wants to maintain that standing by complying with theattacker’s request.Using scarcity, an attacker can direct an employee to a Web site offering a limitednumber of free goodies, and encourage the employee to hurry before they’re all gone. Oncethe employee enters the Web site, he or she is prompted for his or her user ID and password,which is then captured.Once employees have seen demonstrations of these principles, it’s time for role playing,which is best done in small groups, because most people have a fear of public speaking.Notes from the Underground…The ConCon artists know that with enough planning, they can con anyone. If a con artist can’tdefend against a social engineering attack, how can the rest of us?Social engineering can also be done in stages. Each person the social engineercalls is tricked into revealing some small piece of information. After accumulatingthese pieces, the social engineer calls an employee and says, “I have all this information.I’m just missing one detail.” This gives the social engineer authenticity, and thetarget usually gives up the detail.The best defenses are authentication, authorization, administrative controls(e.g., separation of duties), and monitoring.TrainingTraining differs from education in that education is about principles; it’s more general.Training is about procedures; it’s more specific.There should be separate training programsfor general employees, programmers, security professionals, and management to reflect the