about social engineering which is really using manipulation and deception to
persuade people to either release proprietary information or to do some
sort of action that allows the bad guys into the system or to gain information
so let me advance the slide here
everybody remembers the quote by PT Barnum right there's a sucker born every
minute but that's really not why social engineering works we're going to get in
a few moments in later in my presentation I'm going to describe
exactly why social engineering is so effective but the information security
industry as probably all of you know are really focused on technical solutions to
the security problem if you hear about firewalls VPN probably a lot of you when
you're off site you have to VPN here and I don't really know but I I can guess
and there's encryption there's a biometric authentication devices RSA as
a company that develops develops a secure ID device and social engineering
bypasses all of that because it goes directly to the human being because the
bad guy is able to deceive anybody with legitimate access to give up the
information or to transfer that information or to even reveal their
credentials that allows them in and the hackers and the industrial spies don't
just focus on finding technical vulnerabilities what they look for is
the weakest link in the security chain if they can walk into the company and
plug in a wireless access device and hired it under somebody's desk that they
can get to the server room or the telephone closet they're going to take
the easiest route to get what they want of course doing a physical entry is
higher risk for the bad guys and that is one of the reasons why social
engineering is so widely used and you think as the information security
community and these manufacturers that are developing security devices are
making better and better technology to keep the bad guys out of your stuff the
more and more excuse me the more often that
social engineering will be used right because if it's the easier way in that's
the way the bad guy will take now social engineering excuse me one second social
engineering exploits poor awareness because people aren't aware of the
threat they're not they're not aware of the value of information that they're
they're not aware of the consequences of their actions but social engineering
also does also exploit suddenly poor awareness but curiosity and poor
security habit let me give you an example and you notice on the floor
there's a red three and a half inch floppy disk you pick it up it says
extremely proprietary and confidential payroll salary history for all
executives and managers two thousand first quarter 2003 and wonder what's on
here i wonder what wonder if I manager makes nobody will ever know so they go
back to their office or their cubicle they plug it into their computer the
floppy it comes up with a word doc or an excel doc or any other type of file and
it has you know payroll salary history they click on it doesn't come up says
some sort of error message that the file could not open so then they are Good
Samaritan they take this floppy and it turned over to human resources somebody
dropped this in a public place as the sensitive so they get that attaboy well
Human Resources is pulling out their hair because who was stupid enough to
believe this information in the public area so what they do is they put it in
their computer and they do this exact same process well what just happened
anybody now Trojan horse okay when they went to open that document it installed
spyware or a keystroke logger so every keystroke that person's type person
types every password they put in every website they go to every email they
write and receive every instant message they send is surreptitiously done excuse
me of thirsty so surreptitiously is sent out to some free email service provider
like in the Ukraine or anywhere in the world or it could be a reverse back door
which allow which every so often your computer tries to connect to another
computer that's on the internet that's already been compromised by the same
person or group of persons and now the person is able
to connect to your network because when you connect out to that compromised
computer it provides that hacker a reverse tunnel into your system so
that's one way that curiosity really can kill the cat let's go to it looks like
so why does social engineering work so well well how many of you have ever
received a telephone call asking for something that you think is like
innocuous is not really important an employee number another employees
telephone extension an address something that's just that you you know we
normally give out in your in your daily activities well this is one of the main
techniques of a social engineer because what they do is they collect what
appears to be innocuous information from different parts of the enterprise and
when they put it all together it's valuable to them or they when they put
it all together they're able to build their credibility because now they know
as much as a true insider about a particular project who's on vacation
people also underestimate the value of information or if a person is working in
particular department and they know through gossip or because they go to the
pub down the street and where all the employees hang out and they hear what
other project some other department is working on they don't have any personal
investment in the secrecy of that project maybe they even know it's
sensitive but it's they don't have personal investment so they're willing
to talk about it or reveal that information to an outsider