Getting an F and Turning It Into Fun

摘要

It's never fun to get an F, but fun is what I decided we needed to inject into our training when that was the grade we got in one aspect of our recent security assessment. The F came about through a social engineering exercise. The consultant who was hired to do the agency's audit was given an office in our headquarters and a desk phone that was programmed to display "IT consultant" on Caller ID. Then I gave him a list of phone numbers for all the agency employees throughout the state. Making calls at random, the consultant introduced himself, mentioning the name of his company. He then explained that he was working for me and looking at the security controls around our information systems. He just needed the employee to tell him her username and password, he explained, so he could get on with his investigations.