Lessons · Cybersecurity · social engineering
Social engineering: attacking the person, not the machine
Social engineering is getting somebody to do or reveal something by pretending, pressuring or being pleasant, and no software stops it.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
A man in a high-visibility vest with a clipboard walked into the server room behind an employee who held the door. No password was guessed. The control that failed was a person being polite, and the fix is a rule that makes the polite thing and the safe thing the same thing.
How to think about it
Notice the lever: authority (the boss asked me), urgency (right now), reciprocity (I helped you), familiarity (it is me from IT). A request with a lever on it gets verified by a route the requester did not choose.
Worked example
Call: 'IT here, we need your password to fix your mailbox'Lever: familiarity. IT never needs your password, and that rule is what lets a nervous person say no.
Door: following somebody through on their badgeLever: politeness. One badge, one person, and it is fine to ask.
Email: 'I am the new auditor, send me the user list'Lever: authority. Verify with whoever would have hired an auditor.
Write the lever down, then the verification routeNaming the lever makes it visible; naming the route makes refusing easy.
Your turn
Somebody follows an employee through a badge door without their own badge. Write the name of that trick.
trick:
Solve one, graded on the server
The trap
Thinking training alone fixes it. People under pressure do the human thing; a written rule gives them a script for saying no without being rude.