How do you address a social engineering and or software weakness/concern in a company or organisation?

Question

Say that you call your bank and are able to start talking about your personal finances, without having given them any real proof of your identity. Well the first thing I'd think would be to change your bank. But it might not be as practical if company X is your university/college/school or government.

Let's say you are not willing/able to change to another service provider, and you don't want them to be sharing your information with the rest of the world. What do you do? It's hard to call the company and tell it that it needs to do a full pen test. They have a tendency of getting defensive in a situation like this.

So my question is how do you tell/prove to a company that its security is weak and they need to do something about it to stay within the bounds of the law? (I think this mostly applies to larger company/organizations so please focus your answers towards them.)

After all impersonation and most on line security testing is illegal. After all if your name is robert') DROP TABLE students;-- then it's just a question of time until you accidentally find something. :)

How do you address social engineering and/or software weakness/concerns in a company or organisation?

Answer 1

I agree that breaking in is a bad idea.

Also - you might consider that while you are a customer of the organization, going public is also of limited value, since any break-ins that occur are likely to damage you, as well.

I agree that your immediate best bet is to withdraw your affiliation and find a company with better security practices... but I'm staying within the confines of the question and assuming this isn't an option.

A good practice is to hunt down the right person and tell them about your concern. The right person in a big organization can be very hard to find, since it is most likely NOT the guy answering the phone at customer support. Options include:

• trace through customer support management chains until you find someone with a serious enough title that he might take you seriously
• research the company's executive management - in a big enough company, there should be a Chief Security Officer or similar title who has equal power to the person in charge of IT. Often these people don't have easy to find contact information published publicly, but you might try a formal letter as a concerned customer. Just be careful of your wording that this is a request for assistance, not a threat.
• if you honestly can't through to the company, there are often government agencies that cover specific areas of law - it varies from industry to industry. And things like the Better Business Bureau.
• if the issue is truly egregious (and illegal), and the company is big enough, you could retain legal counsel and bring a class action lawsuit.

Most of these are going to take serious time. You'll likely fail on the first few attempts to get help. This can be a major struggle. But if it's your data, and you don't have another option to find a better resource, this kind of battle may be the right option.

YMMV - my experience is centered in the U.S. Can't say that other governments offer the same set of protections.

Answer 2

For social engineering, it is pretty difficult, but still you can ask that any communication with you should be (for instance) via email should be using PGP or using a specific pass code for phone calls.

Now regarding technical stuff, it is fairly easy where you actually are a customer and have the product at your site. In such a case, yes you ask to assess your product via a security consultant. The issues you find you report them back saying you need them fixed as they were identified.

Now regarding On the cloud solutions, like University accounts, online banking,... you need to contact the secure@bank/univ.com and ask them to fix it within a certain time. You politely inform them, that in case of no reply, you would be obliged to contact the press (you need not to do that, just threaten). For sure you will get a reply but that does not mean positive reply but an assessment on whether they would fix it or not. After that it is a case by case.