On-Site Social Engineering Prevention

Social engineering is the use of psychology to manipulate someone into performing particular tasks or providing information to a scammer. In some cases, however, information is volunteered because it isn’t necessarily thought to be significant. However, all personal and professional information is subject to use by cybercriminals. What is done with the information varies based on the objective of the con artist. 

A common misconception is that an employee would know if a criminal came into a facility. While some robberies may be obvious, in other cases criminals will attempt to fly under the radar, often committing crimes directly in front of employees without them ever suspecting a thing.  This is where on-site social engineering comes into play.  

There are many stories of on-site social engineering and they don’t necessarily require the use of technology to succeed. In fact, criminals pose as various people often, and frequently succeed in stealing information, data, mobile devices, laptops, and even servers, often while employees are all around. Popular disguises are heating and cooling technicians, technical support, pest control, inspectors, and other service providers that are often found in office buildings. Therefore, it’s critical to get a little nosey when anyone requires access to non-public areas.

Fortunately there are many things you can do to protect yourself and your organization from on-site social engineers. By simply following the steps listed below, you can greatly reduce the risk of falling victim to this type of attack.

• Never give access to your facility based on an email. Criminals can send email messages that appear to come from co-workers.  If an email directs you to give access to a third party, pick up the phone and call the employee who sent it to confirm the details.

• When visitors arrive at the facility, ask to see ID and log their information. The more you know about a visitor, the less likely they will be to commit a crime of opportunity.

• Make sure confidential information cannot be observed in areas where the visitor is working. Documents should be put away and monitors should be turned off or moved.

• Confirm that visitors cannot overhear confidential conversations either in meetings or by employees on the phone. If a visitor is required to be in an area for an extended period of time, employees should move to other areas, if they are to carry on conversations containing confidential information.

• Don’t assume that just because someone says their service was requested, that they really were requested. Place a phone call back to whomever they say is their contact, or who would be ordering their services, and confirm that indeed the appointment is legitimate. 

• Never leave a visitor unattended. Most on-site social engineering is only successful when a criminal is left unattended.  By escorting the criminal at all times you greatly reduce their ability to commit a crime.

• When escorting a visitor, it is important to maintain visual contact at all times.  An experienced criminal will attempt to find excuses for separation. Common tactics include asking the escort for a cup of coffee, an ink pen, or other office supplies. They may also use the restroom and remain for a long period of time in hopes that the escort walks away.  In any event, never let the visitor have access to the facility unattended for any reason.

• Ask questions when someone unfamiliar is around. Who are they? Why are they there? Don't assume that because someone is in your facility and is unattended, that they are harmless and supposed to be there.  

• Only give visitors access to the area they need to get to.  Don't provide visitors with keys or access cards that can allow them into areas outside of the space in which they need to work.

The most important thing to remember is there is no such thing as a person who looks like a criminal. In many cases, a criminal will be friendly, charming, good looking, or funny or a combination of all of these.  An experienced criminal understands that success is based on the trust of the individuals they are manipulating. Part of that trust comes from how they look and act. It is up to you to treat everyone the same.  Stick to the tips listed above and no matter who they are or how they behave, you will ensure your facility always remains secure.