RE: Steps to avoid Social Engineering

["Patoff Pat-EtHiQ" <patoff22 () hotmail com>]

An easy way, is to have something 'personal' with the other person.
His phone, email etc... at his office or home if it's a company like your 
third party one.

If you seem this suspect, try to recontact the person with the name he gave 
you.
At his 'real' number of phone or via email ask him to reply to your email to 
confirm his
identity.

Any other private aspect via the phone can be retreive, by asking a 
personnal question of something that has happen last time you talk to him 
etc.. but the 'physical way' should be better in this case too.

Hope it helps.

Pat

--------------------
Hello y'all,

    I have a question for you guys (and gals). We all know about social
engineering. Some of us use it on a daily basis. And we all know how
it can be even more dangerous than any computerized attacks, but how
can we protect against it?

    I'll give you an example: we have a database based program that
was written by and maintained by a third party that is in another
city. In the past when they needed access for maintenance, we would
provide them it via VPN. Recently there has been a problem so they
were contacted. Earlier today someone from that company phoned me to
discuss details about the VPN. I haven't given them any information
yet. In this case I am fairly positive it is legit since they knew the
company that we use as well as who lodged the complaint.

    But how could I get this person (or any one in the future) prove
to me that they are the people who are they say they are? Any advice?

Tabs