Lessons · Cybersecurity · social engineering
Social engineering: attacking the person, not the machine
Social engineering is getting somebody to do or reveal something by pretending, pressuring or being pleasant, and no software stops it.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
In beta. This lesson was written for Hone and has not yet been checked by a practising security analyst. Practice material, not professional advice. What that means.
What it is for
A man in a high-visibility vest with a clipboard walked into the server room behind an employee who held the door. No password was guessed. The control that failed was a person being polite, and the fix is a rule that makes the polite thing and the safe thing the same thing.
How to think about it
Notice the lever: authority (the boss asked me), urgency (right now), reciprocity (I helped you), familiarity (it is me from IT). A request with a lever on it gets verified by a route the requester did not choose.
Worked example
Call: 'IT here, we need your password to fix your mailbox'Lever: familiarity. IT never needs your password, and that rule is what lets a nervous person say no.
Door: following somebody through on their badgeLever: politeness. One badge, one person, and it is fine to ask.
Email: 'I am the new auditor, send me the user list'Lever: authority. Verify with whoever would have hired an auditor.
Write the lever down, then the verification routeNaming the lever makes it visible; naming the route makes refusing easy.
Your turn
Somebody follows an employee through a badge door without their own badge. Write the name of that trick.
trick:
Solve one, graded on the server
The trap
Thinking training alone fixes it. People under pressure do the human thing; a written rule gives them a script for saying no without being rude.