4 ms·
When I read Kevin Mitnick's Ghost in the Wires, what impressed me was how he'd combine social engineering with technical hacks. For example even if people did c
by pjungwir 9y ago
When I read Kevin Mitnick's Ghost in the Wires, what impressed me was how he'd combine social engineering with technical hacks. For example even if people did call their boss or Kevin's alleged employer (the utility company, a partner company, whatever), he would have set up their phone system to send the call to himself. I'm sure that social engineering alone gets you a long way, and I'm sure that Kevin was good at it, but when your electronic communications aren't trustworthy you can really do a number on people! How are you even supposed to defend against that?
- 001spartan 9y agoThis is exactly why penetration testers and red teams do these types of engagements. We like to emphasize that organizations need to assume they've been compromised by someone, and they need to constantly keep that in mind when they build security policies and technical controls. You can never keep a determined attacker out, but you can limit the damage that they can do, and make them spend more time getting in.