Social Engineering

In the previous sections, you learned a little about how attacks work. You also learned about TCP/IP and some of its vulnerabilities. You were also exposed to the issues that your users will face so that you can help them from a technical perspective. A key method of attack that you must guard against is called social engineering.

Social engineering is a process where an attacker attempts to acquire information about your network and system by talking to people in the organization. A social engineering attack may occur over the phone, by e-mail, or by a visit. The intent is to acquire access information, such as user IDs and passwords.

These types of attacks are relatively low-tech and are more akin to a con man. Your help desk gets a call at 4:00 A.M. from someone purporting to be the vice president of your company. She tells your help desk personnel that she is out of town, her computer just failed, and she is sitting in a Kinko's trying to get a file from her desktop computer back at the office. The vice president for some reason cannot seem to remember her password and user ID. She tells the help desk representative that she needs access to the information right away or the company could lose millions. Your help desk rep knows how important this meeting is and gives the vice president her user ID and password over the phone. Congratulations, your system has just been hit.

Another very common approach is initiated by a phone call or an e-mail from your software vendor, telling you that they have a critical fix that must be installed on your computer system. If this patch is not installed right away, your system will crash and you will lose all of your data. For some reason, you have changed your maintenance account password and they can't log on. Your systems operator gives the password to the person. Bingo! You have been hit again.

Note 

Users are bombarded with e-mails and messages on services such as AOL asking them to confirm the password that they use. These attacks appear to come from the administrative staff of the network. The attacker already has the user ID or screen name. All they need to complete the attack is the password. Make sure your users never give their user IDs or passwords. Either case potentially completes an attack.

The only preventative measure in dealing with social engineering attacks is to educate your users and staff to never give out passwords and user IDs over the phone, via e-mail, or to anyone who is not positively verified as being who they say the are.