I have a friend who does network administration for a large company. Many years ago, she got a frantic call from a VP saying he was in Asia, losing a deal because he could not log into the VPN to get a powerpoint. He could give many of the details of the company to make you think he was that VP.

She was wrong to trust this person.

Why?

Later, when the FBI came to interview her, she found out she had been socially engineered by the infamous Kevin Mitnick. Hackers, don’t need packet sniffers or brute force attacks to be successful. The weak link is usually just a person who already has access and is willing to aid those who don’t. This why you need to follow the policy of your company because people like me know it is better to do a phone call that have machines runing code to get into the network via math.

Technorati Tags: Hacking, Social Engineering