A Suit, a Thumb Drive, and Lunch Hour

I have been doing this for thirty years, and my first social engineering breach was twenty one years ago. That one came down to attitude, confidence, and reading the person in front of me. 

Meanwhile the technical side has fractured into a hundred specialties and there is an app to monitor the app that monitors the app. The human layer has not evolved at all, and that is still where I would go first if I wanted inside almost any organization today.

Here is what the job actually looks like. I do not need a laptop. I need a suit, a tie, sunglasses, and a thumb drive that now holds two terabytes, which means I can walk a server out in my pocket (perhaps not a big one:)). I need one unlocked laptop with no screen timeout, and lunch hour hands me a floor full of them. 

When someone does challenge me, I keep the lie simple and close to the truth. I am with your auditors, here for the physical inspection. Short of the CEO, the CFO, and your head of legal, almost nobody wants to be the person who pushes back on that.

Every control you buy assumes a person will use it correctly under pressure. Attackers do not need to defeat the control. They need the person who is tired, or new, or afraid of looking difficult in front of someone who sounds senior. Authority pressure is not a technical vulnerability and no scanner has ever flagged it.

Now look at the door. The guard is usually the lowest paid person in the building and the least trained, given a clipboard, a badge reader nobody audits, and no real authority to challenge anyone in the right clothes. Then we hand that person a gun. I actually had one guard escort me thru 4 security doors, badged me thru and left me unattended in the CIO’s office for a meeting I made up. 

We will spend six figures on a detection platform and pay the person standing between the street and the data center barely enough to stay a year. That is not the guard’s failure. It is a decision somebody made in a budget meeting.

What has changed is the cost of the attempt. Voice cloning, generated video, and models that write flawlessly in a second language have made the ability to be convincing cheap. 

The defenses are unglamorous, which is why they stay underfunded. Verify out of band, every time. Enforce screen locks that actually trigger. Give your help desk and your guards a script and the standing authority to tell a vice president no. Run real pretext testing instead of a click rate you can show the board. And pay the people at the door like they matter, because they are the control.

So here is my gut check. If someone walked into your lobby tomorrow in a good suit and said they were with the auditors, how far would they get before anyone pushed back, especially in multi tenant buildings.