... refuse to give any contact information — that's a red flag. If they make a request that's out of the ordinary — that's a red flag. If they make a request for something sensitive — that's when verification is necessary, depending on company policy."
If somebody is flattering you, they might be trying to influence you to cooperate. Or, they might use an authority ruse — they pretend to have a higher status than you to force information from you.
Is it all down to the employees?
People can't be human lie detectors. Companies need to develop a simple security protocol to know when employees should refer to policy, on the intranet. Top management needs to buy into this idea.
Companies should run workshops on responses to social engineering, to demonstrate the foolish feeling people could have if they're tricked. Enterprises need to motivate compliance with policy, and explain why this is important to employees. Businesses should also develop their security policy, and encourage employee participation — educate people. You can hire an outside firm to test security, and see if people can be fooled into revealing information.
There are new laws, in both the US and the UK, regarding monitoring telephone systems. What is your opinion on them?
There's a privacy issue at stake. There's a big scandal at the moment with the Bush administration monitoring systems.
Can that be avoided?
People can use strong crypto, but then so can criminals and terrorists. Security and privacy is always a delicate balancing act.
What's your opinion on Gary McKinnon, the so-called "NASA hacker"? The US is in the process of extraditing him to face charges of hacking into government systems.
He's the UFO guy, right? I think the excuse that he was trying to expose UFOs is laughable — he was allegedly hacking around all sorts of systems.
I think they're trying to make an example out of him — you can't be in another country and escape American justice. Now, I'm not an expert on British law, but surely he could be prosecuted in the UK for the same thing?
