Unmasking the Social Engineer: The Human Element of Security

Chapter 2

What Is Social Engineering?

Enlightenment is not imagining figures of light but making the darkness conscious.

—Carl Gustav

I define social engineering as any act that influences someone to take an action that may or may not be in his or her best interest. As mentioned briefly in Chapter 1, I once was hired to infiltrate warehouses without breaking and entering. To do so, I used the social engineering methods of pretexting, role playing, and three or four different aspects of influence. My intent was to test the company's defenses to see if the employees followed policy. I also tried to take pictures of the exits, camera locations, and other aspects that a real criminal would use to come back later and break in. A typical scenario went something like this:

I drove to the warehouse and pressed the intercom button at the front door. I said, “Hi, this is Paul from your waste company. I need to check the serial number on your trash compactor.”

The door buzzed, and I was let into the inner area of the warehouse. I faced a wall-to-wall, floor-to-ceiling metal mantrap. A security guard looked in and said, “Hold on a minute. The floor manager is coming to escort you.”

A few minutes later, Roy, the floor manager, came out to greet me. I was buzzed through the ominous-looking mantrap and was sent to the security guard desk. The security guard asked for my ID. I looked at him and then at the mantrap and said, “I left my wallet in my car. But I do have my company ID. Is that okay?” ...