I remember having to train a help desk staff where I worked on the concepts of social engineering because of an incident where someone called the HD and the conversation went something like this:
| HD: | Help Desk, this is Rick, how can I help? |
| Caller: | Hi! I seem to have to have forgotten my password and I'm locked out, can you reset my password to "welcome"? I'll change it to something else after I get in. |
| HD: | What is your name? |
| Caller: | OH! My name is Rick C*****! |
| HD | (composing himself as his name is Rick C*****) Oh really? That's my name... |
| Caller: | **** Click! **** |
As a result of that incident I was tasked with developing procedures that the Help Desk could use to verify the identity of callers. (call backs, challenge/response, etc.) There were several other attempts after that which were foiled as the company became larger and more visible.
| Peter L. Berghold | Brewer of Belgian Ales |
| Peter@Berghold.Net | www.berghold.net |
| Unix Professional | |
In reply to Re: Security: Technology vs Social Engineering
by blue_cowdawg
in thread Security: Technology vs Social Engineering
by chunlou
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |