In Depth

Social Engineering: The Fine Art of BS, Face to Face (Includes Video)

A confrontation with a facilities manager demonstrates social engineers' complete comfort dealing with (and manipulating) conflict

By Joan Goodchild, Senior Editor

Page 2

And they did. The staff at the building we examined does get credit for being observant. While Nickerson said none of the interrogation we dealt with during our time there would have deterred him in the slightest from getting his job done, we weren't completely unnoticed. The facilities manager did come out and ask us what we were doing.

This happened about fifteen minutes into our assessment. One of the first things Nickerson did was point out was how the building's generator was both uncaged and unlocked. He even went up to the generator and opened up the doors. About ten minutes later, we were approached by a man who introduced himself as the facilities manager.

"Hi, how are you doing?" Nickerson said casually as he walked up to the approaching man.

"I understand you were looking at the generator and opening the doors on it. I got a security call," the facilities manager said, clearly concerned.

"Actually we are doing a security assessment and pointing out things around the building," said Nickerson.

"OK, and who do you work for?" the man asked.

Nickerson said we worked for CSO and the manager seemed satisfied with that answer.

"Alright, very good," he said as he left us to continue our assessment.

" I have absolutely no credentials on me that verify that," noted Nickerson. "So we were just allowed to go fully access the building, poke at stuff, and now we have a point of verification that is trust. Now we can go in and be even worse with the camera because we already have a pre-verified point and we know security has been called on us for opening generators. They are now actually going to help us into the building knowing full well what we are doing, even though they have no reason to believe us."

Nickerson said during his team's assessments, questions from client staff come up all the time. This is a common occurrence for him and his skill at the fine art of BS is obvious.

"People are usually good about asking what you are doing," he said. "But once you give them a viable excuse, they let you go. As long as you do your intelligence right, you will never get caught. People don't like confrontation."

We spent about 20 minutes more continuing to photograph the building and poking around. The facilities manager checked back on us before we left and asked for more details of our project.