When John arrives, do you allow him to use your computer under your account? “I’m John Newbie - the latest hire in the company’s Tech Support. Director Sue suggested that a good way for me to introduce myself is to install the company’s new anti-spam software on all computers. When would it be convenient for me to stop by and update your office machine?”

FROM: TO: DATE: September 7, 2005 Message to all FriendliWare employees, In response to employee requests, President Pauline has created a new electronic way for you to view your personnel information online. This new system provides access to all salary records, performance evaluations and productivity information. Of course, you can be assured that your personal information is confidential - protected by secure login. To activate this new system every employee needs to follow the following link... http: info.YourCompany.com In the interest of your convenience you can log in using your existing user name and password. Please follow the directions. This should take no more than a couple of minutes of your valuable time. Thanks. Sam Reliable Assistant to President Pauline FriendliWare Corp.

Friday, 4:45 p.m. -- “Hi, this is Sam in Accounting. Is Bob around?” “No? Is this Bob’s assistant, Chris?” “Chris, I don’t know why we haven’t met before. I guess I just haven’t stopped by old Bob’s office in the past few months. You see Bob and I go way back to college days. Our families spend a week every spring in Aruba. In any event, the reason for my call is that Bob and I have been developing this new security system that could save the company thousands. Bob and I plan to pitch our idea to the Board next Tuesday, and I need to polish the PowerPoint slides this weekend. Bob was working on some major revisions and said they would be ready today. He told me that if I missed him you would be able to log into his corporate account and send me a copy of the files I know it’s late, but would you mind ing the files to me?” “You don’t know the presentation file names? Well, I know Bob developed a new spreadsheet and added some nice graphics, but I don’t know the names of these new files. Perhaps it would be easier for you if you just let me log in and access them directly from my office. This would also be more secure, since the company doesn’t use encryption. The odds are slim, but we could lose our jobs if these files were somehow intercepted by a competitor.”

FROM: David RileyDavid Riley TO: David RileyDavid Riley DATE: February 17, 2004 SUBJECT: I love you, David. Someone loves you! Click on the web link below to find out who. A Classic

Def’n ______________ is a category of attack in which the perpetrator manipulates humans into divulging sensitive information. Social engineering preys on human qualities such as... your desire to be _________. your tendency to ________ others. your ________ of getting into trouble. Social engineering is still viewed as the most effective (and often the most convenient) means of breaching security. Social engineering is not based on hardware or software vulnerabilities, but rather human vulnerabilities..

Methods of the Social Engineer befriend your victim trigger rapid response from excitement or fright gather bits of information from various sources impersonate (president, tech support staff) shoulder surfing dumpster diving software mimic phishing

Anatomy of an Attack telephone book local office company web pages reception annual report toll free number staff directory help desk executive assistant lunch restaurant human resources org chart new hire list employee contacts login info

Why is social engineering successful? diffusion of responsibility opportunity for benefit - help desks are particularly vulnerable trust moral responsibility guilt

MITIGATION - policy How should sensitive materials be handled? What information is considered sensitive/confidential? Who should have access to sensitive documents? How are people authenticated? How are electronic documents authenticated? Who is responsible for what?

MITIGATION - infrastructure Sound physical security is essential. Practice good electronic security (firewalls, encryption, etc.) Phone calls can be traced and/or recorded. Selected computer transactions should be logged and audited. An internal website can assist authentication. Conduct simulated attacks.

MITIGATION - awareness be aware of the signs name dropping intimidation request for sensitive info rushed need uniformed personnel be aware of your environment what is your keyboard’s viewing exposure? is your computer logged in? what is your screen’s viewing exposure? are sensitive documents visible? who sent your ? (be header-aware) what web server are you viewing? (be URL-aware)

use callback authentication protocols never share passwords (tech support should have their own accounts) Some specific ideas (for social engineering mitigation) “lockdown” confidential material shred all confidential paper use ctrl-alt-del login (for Windows) mark sensitive/confidential documents require escort of offsite personnel enact introduction procedures for new employees establish procedures to verify identities password lock a computer when you leave the room