Social engineering: employees' loose lips can sink your company network. (Tech Issues).

In the movie, Jumpin' Jack Flash, Whoopi Goldberg's character dons a blue sequined formal gown and high heels, charms her way into the computer room at the British Consulate, and punches up an exit code for a spy stranded in the former Soviet Union. That's "social engineering" in high style. It's less stylish when someone walks away with your customer database, prints checks on your company's bank account, or copies of patients' confidential records. Social engineers can do all that and more without much technical skill. They manipulate people to get into tech systems like the janitor who lets someone back in for a forgotten coat, the receptionist who will show any repair person to the network closet, or the boss who complains about program XYZ causing so many problems.

Social engineering happens more often than you think.

Security engineer Justinn Washington, who heads Rockville, Maryland-based ELS Global Inc. (www.elsgolbal.com), knows how easy it is to crack a company's network. In 1999, he took over management of a network operations center (NOC) for a company with a high turnover rate, little or no maintenance documentation, and lots of fires to put out. Soon after Washington arrived, the NOC got a call from someone requesting the IP address for a Hewlett-Packard printer. "He presented himself to one of our engineers as a contractor providing service," says Washington. "The NOC engineer knew there was a history of maintenance and repair with the printers, so she followed his instructions to print out a statistics page, [which gave him the] IP address, machine name, etc."

But this wasn't about printing. On the network, the print server doubled as a backup domain controller. Bottom line: The imposter could use the statistics supplied to scan for more information, then masquerade as an internal user on the network and potentially gain access to the company's database of customer phone numbers, social security, and credit card information. Washington monitored the IP address and brought in a forensics analyst to track down the impostor. "He hopped from three other companies to a university, which was the last place he could be traced," says Washington.

To prevent this from happening again, Washington instructed all employees to direct questions regarding hardware and software to the IT director. "If you don't know the potential consequences of giving out that information, then you could be socially engineered," he says.

BUT, ALL I SAID WAS....

"Employees often reveal information without realizing it. If someone riding home on the bus says, `Our Exchange Server was acting up today, you're letting others know that your operating system is Windows and you use Exchange Server," says Washington. "That information can be used to plan attacks and to [help crackers] make calls for further information," It's just a matter of using known exploits to a given piece of software when the administrator hasn't patched them or doesn't know about them yet.

But businesses aren't the only ones that are vulnerable; government agencies also fall victim to such practices. "In many agencies, employees are trained to be helpful," says Joan S. Hash, group manager for information security at the National Institute of Standards and Technology (NIST) in Gaithersburg, Maryland. "Social engineers take advantage of people's desire to be helpful." This, of course, makes it easier for them to compromise your organization--and your employees. Hash cites a case in which a husband was searching for his estranged wife: "Through social engineering, he was able to get the name and address of her new employer. He tracked her down and beat her up badly." The type of damage social engineering causes can run the gamut from downed networks, identity theft, or equipment theft--even terrorism, says Hash.

WHAT TO DO NOW

The best defense against social engineering is education, says Andrew A. Ryan, CEO of Andrew Ryan Consulting, Inc. of Alexandria, Virginia (www.andrew ryanconsulting.com), and currently IT consultant for the National Society of Black Engineers (www.nsbe.org) also in Alexandria. "IT personnel should not assume that end-users are as adept at recognizing technological risks as they are. Therefore, it's really important to educate your end users that these things can happen."

One way to do this in a small company is to identify a "point person," someone in charge of what happens to the system. "In a larger organization, there needs to be a more efficient process for validating the authenticity of an individual. It may be as simple as issuing corporate IDs with different color dots on a rotating basis, so someone using an old or stolen ID can easily be recognized."

Hash adds that companies should also make sure employees report any calls asking for information about tech systems to the security representative in the organization. "Every agency chief information officer who runs the IT department and is also in charge of making sure they have a well-supported, fully functioning security program in place," says Hash. She adds that the NIST works with both the government and private sector, reaching out to small- and medium-size businesses at security forums and conferences. Companies can also check out private business support and best practices at NIST's Computer Security Resource Center at http://csrc.nist.gov.

"A company can spend thousands of dollars on intrusion detection software, virus detection software, malicious intrusion detection, and firewalls--and someone can walk right in and say they're from the local computer company and then trash your systems," says Ryan. "Physical security is often the most overlooked aspect of security, and you've got to wrap your arms around it."

Proper Terms

* Cracker A cracker uses computer technology to break into other systems to steal or destroy property, whether tangible or intellectual. Crackers aren't necessarily gifted technologically, but they use technology as a means to an end.

* Hacker The term refers to a person who enjoys learning the details of programming systems just for the sake of doing so; they often quietly advise the owner of a compromised site or network where vulnerabilities lay. Though unauthorized access is illegal, hackers distance themselves from those who invade systems to steal or destroy.

* Social Engineer Akin to a con man or other sociopath, the social engineer manipulates people to gain access to systems. Rather than depending solely on technological prowess, he or she relies on people's naivete, goodwill, professional courtesy, and hesitance to question others to gain information.

Gentle Reminders

Andrew Ryan offers these tips for helping employees keep security in mind at all times:

1. Put your security policy in the employee handbook, and make it one of the things you review with new employee.

2. Place security alerts on your Intranet page where there is access to sensitive data, such as purchase orders, expense reports, and timesheets--all areas that only your employees should be privy to.

3. Remind employees that no one should ever ask them for their password.