Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs and people are all to happy to hand over their password and laptop when I tell them I'm here to fix it.

share|improve this question

3 Answers 3

up vote 6 down vote accepted

as @TerryChia said the correct defence against this kind of attack is strong policies. In this case users should be trained not to provide passwords to people in person or on the phone regardless of what the circumstances are.

If IT need to log in to a users account they should either use something like sudo (for *nix environments) or if that's not available either reset the users password before doing the work and then reset it again afterwards or alternatively they could use an approved remote control mechanism that has strong authentication requirements.

The key is to set policies up in a way that does not encourage people to break them. If it becomes the norm that IT staff are asking users for their passwords then when an attacker does the same thing, the users will just go along with it. However if IT never ask for passwords and it's company policy that they shouldn't, users are far more likely to recognise this as an attack and react accordingly.

As with anything with humans, there's no perfect defence, but correctly designed and implemented policies go a long way to helping.

share|improve this answer

Train the employees properly.

Teach them the need and importance of verifying a person's identity through some sort of identification method before handing over important information.

No amount of technical measures in place can protect against clueless users. So make sure your users aren't clueless.

share|improve this answer
    
How could the persons identity and level of authority be determined? I don't think it's a matter of cluelessnes, since it is legitimate there could be new staff. –  Celeritas Feb 24 '13 at 9:35
    
@Celeritas Have your employees carry around ID passes or something like that? While it isn't impossible to impersonate, it would certainly make things harder.. Basically just don't hand over important stuff to anyone who ask for it.. –  Terry Chia Feb 24 '13 at 9:47

Institute a reward system for safe behavior, so that employees become used to asking for credentials even from IT staff that they know well.

More importantly, don't punish employees for safe behaviors, or reward them for unsafe.

Scenario

New-hire VIP (VIP) enters office, has forgotten password. VIP asks to use Secretary's (SEC) login today so they can get to work. SEC complies. VIP - with acceptable people skills - says "thank you" and maybe brings roses next day. SEC has been reinforced in behavior "Help people access system."

Scenario

VIP enters office, has forgotten password. VIP asks to use SEC's login today so they can get to work. SEC denies. VIP fetches SEC's immediate superior who berates SEC for obstructing the work place. SEC has been reinforced in behavior "Comply with requests from superiors even if you don't know for sure they're superior."

Half of the problem is that your VIP and SEC are running on hardware designed to work in a Neolithic tribal society and so SEC (Lower status in the tribe) has a natural inclination to do as VIP (Higher status, maybe even chief of tribe) wants unless there is a taboo against it. Institute that taboo. Make it obvious to everybody that VIP, not SEC, is the one in the wrong in this situation. Have managers back SEC, not VIP - even when VIP is the manager.

This, like many other things, will not happen without the backing of management.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.