Social Engineering Tactics Behind a $24,000 Heist

Social Engineering Tactics Behind a $24,000 Heist

Reflecting on the readings and video few actions stuck with me. The first is social engineering is an critical skill to gain access to information in organizations. I have received many cold calls over the years with interest in collecting information about the organization I worked. One does not know if these people are true salespeople or fishing for information. The same held true with Nickerson gaining access to the people he socially engineered to get the information to gain access to his target.

Influence and Persuasion Fundamentals

Their five fundamentals of influence and persuasion as discussed by Hadnagy (2010) are crucial in obtaining any type of successful influence upon a target. The fundamentals areas are setting clear goals, building rapport, being observant of one's surroundings, being flexible and getting in touch with yourself.

In the $24,000 heist, a rapport was built using the disguise of a magazine reporter doing a story on the jewelry store. A perfect pick by Chris Nickerson to get have the owners of the business share information about the success they have had with the jewelry and so much more information. In the case of the retail company with a large call center, using cookies to build a rapport with some and hanging out in a smoking lounge was two great social engineering techniques.

Lessons for Physical Security

The jewelry store owner was exposed with his badge since swiping the card was the only security method needed to get into the office/store. A better technique may have been some sort of two-factor authentication to be sure the person with the card was actually in possession of the owner. Requiring aa pin code to enter the office or another two-factor authentication method would have made entering the office harder for Nickerson and his team to pull off the heist.

References

Hadnagy, C. (2010). Social engineering: The art of human hacking. Indianapolis, IN: Wiley.