As part of the Network Security class I am taking I was required to respond to a case study in the Security+ Guide to Network Security Fundamentals textbook. I thought the case study presented a realistic example how social engineering can be used to gain access to a companies network and included a summary of the case study and my response below.
Case
Project 2-6: Community Site Activity
Case
project 2-6 involves reading a security case study involving an
auditor who was hired to determine if he could gain access to the
network of a corporation. The CEO of the corporation proudly
proclaims the auditor will not gain access to the corporate network
because the network is secure and the company operates in a
confidential and secret manner. The auditor uses social engineering
to discover information about the CEO, then uses the information to
have the CEO willingly open an email attachment, opening a back door
into the corporate network (Ciampa, 2012, p. 77). The full case
study can be found on page 77 of Security+ Guide to Network Security
Fundamentals.
After
reading the case study, the following questions are asked: What
would you say to the CEO? Why? What recommendations would you make
for training?
According
to the case study, the auditor was able to determine some information
about the CEO via Facebook.com. I would recommend the CEO not have
an account on Facebook.com, but if the CEO insists on having a
Facebook account he limits the amount of public information to only
his name. Unfortunately, Facebook does not make it easy for users to
change security settings and verify their account is not sharing more
information than the user wishes to share. According to a June 2011
post by Graham
Cluley from at Sophos, “Most Facebook users still don't know how to
set their privacy options safely, finding the whole system confusing.
It's even harder though to keep control when Facebook changes the
settings without your knowledge”
(http://nakedsecurity.sophos.com/2011/06/07/facebook-privacy-settings-facial-recognition-enabled/).
I would also recommend the CEO limits the amount of public
information available on other websites (e.g. Twitter, Flicker,
blogs, etc) as easy access to information about the CEO is what
allowed the auditor in this case study to penetrate the corporate
network.
I
think it would be advantageous for all companies to hold quarterly
security training. Since the world of network/IT security is
changing at such a fast pace, 15,000 – 20,000 new phishing attacks
are launched each month (Ciampa, 2012, p. 60), IT professionals must
continually educate end-users as to what the new attacks are and how
they operate. Another recommendation is for companies to create a
corporate intranet where new security attacks are updated on a weekly
basis, thereby, allowing end-users to stay on top of the latest
security threats.
Finally,
security training must educate end-users on both the software
vulnerabilities (e.g. inserting a USB drive from home into a company
computer), and the social engineering vulnerabilities such as
providing a caller with information about the company computer (e.g.
type of operating system, vendor of anti-virus, etc). Unfortunately,
companies regularly place tools with company secrets and access to
company networks (computers, smart phones, tablets) in the hands of
their employees without continually educating the employee how to
securely use the tools they are given. While no company will ever be
100% safe from malicious attacks on their network and devices, we can
minimize the number of successful exploits by continuing to educate
end-users.
