Have you ever heard of the term "Social Engineering"

I have to admit until recently Social Engineering was something I wasn't very familiar with.  In the past year or so it's something I have become well aware of, fortunately not due to a bad experience.

So what is it?

The term originally was associated with social sciences, but as I will explain it has also gained a new definition.  Wikipedia defines it as "Social engineering is the art of manipulating people into performing actions or divulging confidential information. While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access; in most cases the attacker never comes face-to-face with the victim."  

What form of deception can be involved

Well, if you asked me a couple of months ago I would have used an example of one of the email scams we've all seen recently attempting to get you to act quickly and devulge personal details like your bank website login or any number of other scams.  But I've been reading Ghost in the Wires by imfamous hacker turned consultant Kevin Mitnick.  Mitnick is a driving force in the new definition of the term.  In the days before the personal computer was commonplace he used his knowledge that he gained of how the phone companies worked to gain access to switches and other phone company equipment and perform tasks too numberous to explain here.  That was just the beginning, he also used his techniques to pose as a bank employee to get account information over the phone.  As I read the book I'm just amazed at the information one individual can obtain just by being knowledgeable about the processes and gaming the system to get access to information they are not privy to.

Why should I be concerned?

It's human nature to trust people who presents themselves as a authoritative figure.  It's not a bad thing, but it can be exploited.  My point is that innocent until proven guilty is not necessarily the right approach when sensitive information is involved.  The next time you encounter an email or phone call that is from someone you know or may not know it's worth asking some questions.  It may take a few more seconds, but you may just protect your privacy or even information that is important to your employer.