How do you know the person sending an email is the person you believe it to be? How do you know the person on the other end of that instant message is the true account holder? How do you know the text you just received came from the owner of the phone? All employees must show vigilance and to be vigilant they have to have process and proper expectations.
Imagine a stalker finding the name of the senior VP of HR on LinkedIn and then calling IT pretending to be that individual, demanding his password be reset. Next, the criminal contacts his victim’s manager via email asking for personal information about the individual?
How about a hacker pretending to be the CFO and then sending an email to an accounts 
payable clerk to cut a check to a 3 party vendor for services rendered. This false CFO then follows up that email with a quick instant message. How many employees would think to question this? Does your business have processes and training in place to protect your business from these types of attacks?
Social engineering, also known as human hacking, takes on several forms. Some as basic as a phone call with the caller pretending to be someone they are not, others as sophisticated as outlaws getting a job with a cleaning crew or telephone company for physical access to an environment. Corporate leadership must understand the risks of social engineering and take steps to protect their organizations.
One of the greatest “hackers” of all time, Kevin Mitnick, would pretend to be someone he wasn’t to gain trust, and later access, to company systems. He was so thorough in his actions he once joined a cleaning crew so he had physical access to environments where he easily penetrated their systems and stole valuable information. Social Engineering grows more and more sophisticated and much of it comes from what Kevin Mitnick started decades ago.
Ever notice how almost no one locks their computer when they walk away? I’ve seen lawyers, human resources employees, and even the controller of an organization leave for long periods of time without locking their computers. How much critical, private, and personal information do these employees have access to? How difficult is it for a disgruntled employee to walk into one of these offices, close the door, and have at the information these key staffers have access to? How hard would it be to get on their managers computer, or an HR system during a company event, or lunch break? Once on the system they could send payroll an email pretending to be a person of authority, and ask for additional funds to get transferred as a “bonus” or “expense reimbursement?” Does your organization think in these terms? If not, it should.
One company I worked at had a situation where an outside party registered a similar Internet domain name to ours. They then created email accounts using the CEO and CFO names. The criminals sent an email to the controller pretending to be the CEO asking the CFO to wire money to an account. The controller began the process to send the money. Internal checks and balances caught this employee’s error and prevented the funds transfer. The controller made an egregious error, fortunately process saved the day. Does your company have this protection? Does the leadership of your business have the awareness to protect corporate funds from attacks such as this?
Most people are aware of phony email when it comes from a trusted source. For example, when a friend or co-worker sends the ubiquitous message “Hey check out this cool website I found…” we all know this is bogus and we stay away. It’s important for business to reac
h this level of awareness for the more sophisticated human hacking attempts mentioned above as well as dozens of others. Leadership has an obligation to protect company information. The way around the vast majority of attacks is simply awareness. Processes and procedures must exist that protect against human error.
Humans are easier to hack than computer systems and networks. Most people are raised to be kind and helpful leading them to inherently trust others. The concept of bad people taking advantage of the good and honest does not sit well with most people. Unfortunately, evil exists and we all must have awareness and behave in a fashion that balances our desire to help others while protecting that which we are responsible for. “Protecting the organization from being victimized by hackers using social engineering tactics has to be the responsibility of each and every employee – every employee.”[1]
Like Gungon Consulting on Facebook
Follow us on Twitter @Gungonconsult
Eric Jeffery has 20+ years’ experience with Information Technology including stints in the Retail, Aerospace, Defense, Hardware, Entertainment and Healthcare industries. Eric has a Bachelor of Arts degree in Economics from the University of Colorado at Boulder. Mr. Jeffery recently founded Gungon Consulting to help businesses solve the exact problems mentioned in this article. You may contact Eric at eric@gungonconsulting.com.
Gungon Consulting 