4 ms·

> it should be no surprise that "social engineering works." Is it really social engineering if the employees followed the Microsoft policy, however crappy it

• david_shaw 14y ago
  > Is it really social engineering if the employees followed the Microsoft policy I'd say that the attack vector is still social engineering; the difference here is that the result is not based in policy failure. Normally we recommend that clients require their employees to attend security awareness training, in order for them to understand social engineering risks and remind them to follow the correct policies that are put in place. In this instance, however, there is no policy being broken. My summation of the issue would be that it is a policy failure being exploited by a social engineering attack vector.
• smsm42 14y ago
  If it's exploiting human factor vulnerability as opposed to software/hardware vulnerability, it is social engineering. It's like saying "this is not a vulnerability because our software does not have a buffer overflow - it just allows anybody who enters admin/admin as login/password to have full access". It's only worse if policies are so broken that you don't even have to violate them to get unauthorized access.