People Skills in the Digital Age

Social Engineering and Owning the Box

I once worked as a Security guard for Quebecor World in Lincoln, NE. Nothing glamorous by any means, but unique in the fact that my 5.75 an hour rent-a-cop security guard job required me to go through a 1 month background check complete with credit records and criminal record pulls, interviews with the State Patrol, and multiple inquiries into my previous employment history. Why would this be necessary for such a mundane job? Who cares about the criminal background of a security guy on third shift at a printer?

Quebecor prints, among other things, AOL CDs and pre-approved credit card applications and has at any time several hundred thousand names, addresses, phone numbers, credit card numbers, and social security numbers in (relatively) plain view. The dumpsters are locked outside. A special shredder devours waste paper into confetti pieces smaller than the end of an infants little fingernail, and then shreds them again. Not that these precautions are not a good start, but in about 10 minutes, an employee inside with a grudge or someone with access to some money can enlist the help of a for profit company to reconstruct paper shreddings into a sembla

. . .

View the whole essay, without interruption

They approach it with the mindset of applying the latest firewalls, intrusion detection systems, access controls, and (sometimes) draconian user policies in hopes of preventing an attack or possible loss of proprietary information. The people who fall prey to social engineering scams – whether it’s a ruse by an outsider pretending to be a company manager who needs a password changed or e-mail from a stranger pretending to be a wealthy Nigerian with money to give away – are those who haven’t heard about the scam. As the knowledge spread, the growing number of phone phreaks became a minor culture onto their own. Noticed anything unusual in your credit report lately?

In this paper I researched social engineering. Social engineering tactics usually exploit identifiable human traits such as fear, greed, and trust, and use the somewhat predictable response characteristics of these traits to obtain information that would otherwise be inaccessible. Many computer types just don't understand it; in the same way they don't understand office politics. - Non-observable Relationship Awareness) allowed him to gain super user access to most of the systems that he was eventually charged with tampering with.

• The policies must be disseminated to all users of the network, with education and training provided as to why compliance is essential. To save money, AT&T set their entire network to this 2600HZ standard.

Protecting the network from social engineering attacks requires, first and foremost, a set of security policies that lay out the reasons and procedures for responding to these types of requests. Mitnick had a cell phone by those providers at different times and because he had a Novell program on his computer they are listed in the same weight SUN.

• Requirement that users log off or use password protected screensavers when away from the computer, cautionary instructions on ensuring that no one is watching when you type in logon information, etc. As a result, Mitnick was held for 4.

Approximate Word count = 2639
Approximate Pages = 11 (250 words per page double spaced)

Simply subscribe to view this paper, and 100,000 others.