Once inside, he was able to give his other team members illegal entry as well. The shirt helped him convince building reception and other employees that he was a Cisco employee on a technical support visit. In the article Anatomy of a Hack a penetration tester walks through how he used current events, public information available on social network sites, and a $4 Cisco shirt he purchased at a thrift store to prepare for his illegal entry. With an access card or code in order to physically get inside a facility, the criminal can access data, steal assets or even harm people. Once a social engineer has a trusted employee's password, he can simply log in and snoop around for sensitive data. Social engineering has proven to be a very successful way for a criminal to "get inside" your organization.
Social engineering is the art of exploiting human psychology, rather than technical hacking techniques, to gain access to buildings, systems or data.įor example, instead of trying to find a software vulnerability, a social engineer might call an employee and pose as an IT support person, trying to trick the employee into divulging his password.įamous hacker Kevin Mitnick helped popularize the term 'social engineering' in the '90s, although the idea and many of the techniques have been around as long as there have been scam artists.Įven if you've got all the bells and whistles when it comes to securing your data center, your cloud deployments, your building's physical security, and you've invested in defensive technologies, have the right security policies and processes in place and measure their effectiveness and continuously improve, still a crafty social engineer can weasel his way right through (or around).
0 kommentar(er)
