<

Sure I Know -- But Who’s Asking . . .?

Many of you may already know this. Some of you may have heard of it. Others remain in the dark on the subject, simply because the term "social engineer" is unknown to them.

"Social Engineering" is definitely lo-tech – its success depends entirely on interpersonal communication, trust, and imagination, rather than technical skill. It is also one of the most significant security threats we face in our high-tech industry.

Unfortunately, you are the social engineer's best friend.... yes - you! You hold the answers to the social engineers questions. Without you, there would be no social engineering.

What is “Social Engineering”?

Social Engineering is the misrepresentation by an individual to intentionally deceive you into believing he/she is a trusted party; thus, convincing you to reveal information you would not normally disclose – such as your UserID or password. Social Engineering is a significant threat to proprietary information and computer security. It may be carried out face-to-face, by phone, through the email, or virtually any point of human interaction, and could easily lead to the compromise of a company’s voice or data network(s).

In many cases, a hacker will simply call a company and randomly attempt to gather as much information as possible. Despite your best intentions, you may unwittingly provide the caller with information they are seeking. This is the start of the social engineering process.

Armed with this new information, this individual will continue to call other employees until they have pieced together enough information to eventually sound like an employee. They will now use this knowledge to gain your trust and convince you to provide sensitive information for what may sound like a legitimate purpose.

For instance...

"Hi, I'm Al Jones. I'm one of the system administrators from your LAN group here at (your location). We are moving your e-mail account to a new platform and the authentication file for several users has been corrupted. In order to ensure all of your email is getting through, I need your login password to fix the authentication file."

This kind of social engineering can eventually provide the caller with enough information to penetrate our networks and launch an attack from the inside. How could that happen? Armed with the information you provided, the attacker now appears to be a legitimate user, effectively bypassing security defenses meant to keep unauthorized users out. As a result, data may be stolen or corrupted, sensitive information about employees and customers obtained, or routing tables corrupted or sabotaged impacting operations and profitability. Not only that, the information you provided will most likely point right back to you -- once the damage is done.

Your awareness of this kind of security threat is the first line of defense. If something doesn't sound legitimate, it probably isn't, so take a minute to check it out before your give out sensitive or critical information.

• Verify the identity of callers:
If you can't immediately identify the caller, insist on calling them back. If it’s an important call from an important person, they too will be concerned with the security of your organization and respect the precautions you undertake. Don't forget to verify the number you are calling back to.

• Don't give out information about other employees:
For example, do not provide employee names, staff positions, locations or telephone numbers, particularly if they are security or information systems personnel, network administrators or PC support technician. Instead, take a message and route it to the appropriate person.

• Don't discuss computers, software or communications equipment:
Unless you know, or can verify the identity of the caller, don't provide questionable information to individuals identifying themselves as vendor support for hardware or software, other outside services.

• Know your company policy for responding to any type of news/media/public inquiries:
News media contacts / responses to media inquiries / public discussion should be made only through a company-authorized spokesperson. All questions by news reporters should be immediately referred to the company/corporate public relations department.

• Report known or suspected social engineering attempts:
If you believe you've thwarted an attempt report it immediately. If you believe you've been duped, don't bury your head in the sand and hope the problem goes away. It won’t. The information you provided may not be used right away, or even in a manner that seems apparent to you. Report the incident to your manager or security department immediately -- don't wait to see if anything happens.

Additional guidelines for protecting yourself and your company from social engineering should be found in your company’s policies & procedures handbook.

More on this under-emphasized topic can be found on the web:
• Social Engineering
Social Engineering: A Backdoor to the Vault
Mitnick teaches 'social engineering'
Cracking a Social Engineer
Social Engineering
And Remember:
Know who is asking for information. Protecting a company’s critical information resources is every employee’s responsibility.

In light of current state of the world, I thought I should share the above. A majority of the type comes from our security department here at UUNet. The URLs provided are from a quick web search.

“Security Begins With You.”

Dan