The Art of Deception: Controlling the Human Element of Security (17 page)

At the very least, the employee should record the caller's name, phone number, and office or department, and then hang up. Before calling back he should verify that the organization really does have an employee of that name, and that the call back phone number matches the phone number in the on-line or hard-copy company directory. Most of the time, this simple tactic will be all that's needed to verify that the caller is who he says he is.

Verifying becomes a bit trickier when the company has a published phone directory instead of an on-line version. People get hired; people leave; people change departments, job positions, and phone. The hard-copy directory is already out of date the day after it's published, even before being distributed. Even on- line directories can't always be relied on, because social engineers know how to modify them. If an employee can't verify the phone number from an independent source, she should be instructed to verify by some other means, such as contacting the employee's manager.

Why is it so easy for an outsider to assume the identity of a company employee and carry off an impersonation so convincingly that even people who are highly security conscious are taken in? Why is it so easy to dupe individuals who may be fully aware of security procedures, suspicious of people they don't personally know, and protective of their company's interests?

Ponder these questions as you read the stories in this chapter.

THE EMBARRASSED SECURITY GUARD Date/Time: Tuesday, October 17, 2:16 A.M. Place: Skywatcher Aviation, Inc. manufacturing plant on the outskirts of Tucson, Arizona.

The Security Guard's Story Hearing his leather heels click against the floor in the halls of the nearly deserted plant made Leroy Greene feel much better than spending the night hours of his watch in front of the video monitors in the security office. There he wasn't allowed to do anything but stare at the screens, not even read a magazine or his leather-bound Bible. You just had to sit there looking at the displays of still images where nothing ever moved.

But walking the halls, he was at least stretching his legs, and when he remembered to throw his arms and shoulders into the walk, it got him a little exercise, too. Although it didn't really count very much as exercise for a man who had played right tackle on the All-City champion high school football team. Still, he thought, a job is a job.

He turned the southwest corner and started along the gallery overlooking the half- mile-long production floor. He glanced down and saw two people walking past the line of partly built copters. The pair stopped and seemed to be pointing things out to each other. A strange sight at this time of night. 'Better check, "he thought.

Leroy headed for a staircase that would bring him onto the production-line floor behind the pair, and they didn't sense his approach until he stepped alongside. "Morning. Can I see your security badges, please," he said. Leroy always tried to keep his voice soft at moments like this; he knew that the sheer size of him could seem threatening. "Hi, Leroy," one of them said, reading the name off his badge. "I'm Tom Stilton, from the Marketing office at corporate in Phoenix. I'm in town for meetings and wanted to show my friend here how the world's greatest helicopters get built."

"Yes, sir. Your badge, please," Leroy said. He couldn't help noticing how young they seemed. The Marketing guy looked barely out of high school, the other one had hair down to his shoulders and looked about fifteen.

The one with the haircut reached into his pocket for his badge, then started patting all his pockets. Leroy was suddenly beginning to have a bad feeling about this. "Damn," the guy said. "Must've left it in the car. I can get it--just take me ten minutes to go out to the parking lot and back."

Leroy had his pad out by this time. "What'd you say your name was, sr. he asked, and carefully wrote down the response. Then he asked them to go with him to the Security Office. On the elevator to the third floor, Tom chatted about having been with the company for only six months and hoped he wasn't going to get in any trouble for this.

In the Security monitoring room, the two others on the night shift with Leroy joined him in questioning the pair. Stilton gave his telephone number, and said his boss was Judy Underwood and gave her telephone number, and the information all checked out on the computer. Leroy took the other two security people aside and they talked about what to do. Nobody wanted to get this wrong; all three agreed they better call the guy's boss even though it would mean waking her in the middle of the night.

Leroy called Mrs. Underwood himself, explained who he was and did she have a Mr. Tom Stilton working for her? She sounded like she was still half-asleep. "Yes," she said.

"Well, we found him down on the production line at 2:30 in the morning with no ID badge." Mrs. Underwood said, "Let me talk to him."

Stilton got on the phone and said, "Judy, I'm really sorry about these guys waking you up in the middle of the night. I hope you're not going to hold this against me."

He listened and then said, "It was just that I had to be here in the morning anyway, for that meeting on the new press release. Anyway, did you get the email about the Thompson deal? We need to meet with Jim on Monday morning so we don't lose this. And I'm still having lunch with you on Tuesday, right?" He listened a bit more and said good-bye and hung up.

That caught Leroy by surprise; he had thought he'd get the phone back so the lady could tell him everything was okay. He wondered if maybe he should call her again and ask, but thought better of it. He had already bothered her once in the middle of the night; if he called a second time, maybe she might get annoyed and complain to his boss. "Why make waves?" he thought.

Okay if I show my friend the rest of the production line? Stilton asked Leroy You want to come along, keep an eye on us ?

"Go on, Leroy said. "Look around. Just don't forget your badge next time. And let Security know if you need to be on the plant floor after hours--it's the rule." I'll remember that, Leroy," Stilton said. And they left.

Hardly ten minutes had gone by before the phone rang in the Security Office. Mrs. Underwood was on the line. "Who was that guy?!" she wanted to know. She said she kept trying to ask questions but he just kept on talking about having lunch with her and she doesn't know who the hell he is.

The security guys called the lobby and the guard at the gate to the parking lot. Both reported the two young men had left some minutes before.

Telling the story later, Leroy always finished by saying, "Lordy, did boss chew me up one side and down the other. I'm lucky I still have a job."

Joe Harper's Story Just to see what he could get away with, seventeen-year-old Joe Harper had been sneaking into buildings for more than a year, sometimes in the daytime, sometimes at night. The son of a musician and a cocktail waitress, both working the night shift, Joe had too much time by himself. His story of that same incident sheds instructive light on how it all happened.

I have this friend Kenny who thinks he wants to be a helicopter pilot. He asked me, could I get him into the Skywatcher factory to see the production line where they make the choppers. He knows I've got into other places before. It's an adrenaline rush to see if you can slip into places you're not supposed to be.

But you don't just walk into a factory or office building. Got to think it through, do a lot of planning, and do a full reconnaissance on the target. Check the company's Web page for names and titles, reporting structure, and telephone numbers. Read press clippings and magazine articles. Meticulous research is my own brand of caution, so I could talk to anybody that challenged me, with as much knowledge as any employee.

So where to start? First I looked up on the Internet to see where the company had offices, and saw the corporate headquarters was in Phoenix. Perfect. I called and asked for Marketing; every company has a marketing department. A lady answered, and I said I was with Blue Pencil Graphics and we wanted to see if we could interest them in using our services and who would I talk to. She said that would be Tom Stilton. I asked for his phone number and she said they didn't give out that information but she could put me through. The call rang into voice mail, and his message said, "This is Tom Stilton in Graphics, extension 3147, please leave a message." Sure--they don't give out extensions, but this guy leaves his right on his voice mail. So that was cool. Now I had a name and extension.

Another call, back to the same office. "Hi, I was looking for Tom Stilton. He's not in. I'd like to ask his boss a quick question." The boss was out, too, but by the time I was finished, I knew the boss's name. And she had nicely left her extension number on her voice mail, too.

I could probably get us past the lobby guard with no sweat, but I've driven by that plant and I thought I remembered a fence around the parking lot. A fence means a guard who checks you when you try to drive in. And at night, they might be writing down license numbers, too, so I'd have to buy an old license plate at a flea market.

But first I'd have to get the phone number in the guard shack. I waited a little so if I got the same operator when I dialed back in, she wouldn't recognize my voice. After a bit I called and said, "We've got a complaint that the phone at the Ridge Road guard shack has reported intermittent problems--are they still having trouble?" She said she didn't know but would connect me. The guy answered, "Ridge Road gate, this is Ryan." I said, "Hi, Ryan, this is Ben. Were you having problems with your phones there?" He's just a low-paid security guard but I guess he had some training because he right away said, "Ben who-- what's your last name?" I just kept right on as if I hadn't even heard him. "Somebody reported a problem earlier."

I could hear him holding the phone away and calling out, "Hey, Bruce, Roger, was there a problem with this phone. He came back on and said, "No, no problems we know about."

"How many phone lines do you have there?" He had forgotten about my name. "Two," he said. "Which one are you on now?" "3140." Gotcha! "And they're both working okay?" "Seems like." Okay, I said. Listen, Tom, if you have any phone problems, just call us in Telecom any time. We're here to help."

My buddy and I decided to visit the plant the very next night. Late that afternoon I called the guard booth, using the name of the Marketing guy. I said, "Hi, this is Tom Stilton in Graphics. We're on a crash deadline and I have a couple of guys driving into town to help out. Probably won't be here till one or two in the morning. Will you still be on then?" He was happy to say that, no, he got off at midnight. I said, "Well, just leave a note for the next guy, okay? When two guys show up and say they've come to see Tom Stilton, just wave 'em on in--okay?"

Yes, he said, that was fine. He took down my name, department, and extension number and said he'd take care of it.

We drove up to the gate a little after two, I gave Tom Stilton's name, and a sleepy guard just pointed to the door we should go in and where I should park.

When we walked into the building, there was another guard station in the lobby, with the usual book for after-hours sign-ins. I told the guard I had a report that needed to be ready in the morning, and this friend of mine wanted to see the plant. "He's crazy about helicopters," I said "Thinks he wants to learn to pilot one." He asked me for my badge. I reached into a pocket, then patted around and said I must have left it in car; I'll go get it. I said, "It'll take about ten minutes." He said, Never mind, it's okay, just sign in." Walking down that production line--what a gas. Until that tree-trunk of a Leroy stopped us.

In the security office, I figured somebody who didn't really belong would look nervous and frightened. When things get tight, I just start sounding like I'm really steamed. Like I'm really who I claimed to be and it's annoying they don't believe me.

When they started talking about maybe they should call the lady I said was my boss and went to get her home phone number from the computer, I stood there thinking, "Good time to just make a break for it." But there was that parking-lot gate--even if we got out of the building, they'd close the gate and we'd never make it out. When Leroy called the lady who was Stilton's boss and then gave me the phone, the lady started shouting at me "Who is this, who are you!" and I just kept on talking like we were having a nice conversation, and then hung up.

How long does it take to find somebody who can give you a company phone number in the middle of the night? I figured we had less than fifteen minutes to get out of there before that lady was ringing the security office and putting a bug in their ears.

We got out of there as fast as we could without looking like we were in a hurry. Sure was glad when the guy at the gate just waved us through.

Analyzing the Con It's worth noting that in the real incident this story is based on, the intruders actually were teenagers. The intrusion was a lark, just to see if they could get away with it. But if it was so easy for a pair of teenagers, it would have been even easier for adult thieves, industrial spies, or terrorists.

How did three experienced security officers allow a pair of intruders to just walk away? And not just any intruders, but a pair so young that any reasonable person should have been very suspicious?

Leroy was appropriately suspicious, at first. He was correct in taking them to the Security Office, and in questioning the guy who called himself Tom Stilton and checking the names and phone numbers he gave. He was certainly correct in making the phone call to the supervisor.

But in the end he was taken in by the young man's air of confidence and indignation. It wasn't the behavior he would expect from a thief or intruder--only a real employee would have acted that way.., or so he assumed. Leroy should have been trained to count on solid identification, not perceptions.

Why wasn't he more suspicious when the young man hung up the phone without handing it back so Leroy could hear the confirmation directly from Judy Underwood and receive her assurance that the kid had a reason for being in the plant so late at night?

Leroy was taken in by a ruse so bold that it should have been obvious. But consider the moment from his perspective: a high-school graduate, concerned for his job, uncertain whether he might get in trouble for bothering a company manager for the second time in the middle of the night. If you had been in his shoes, would you have made the follow-up call? But of course, a second phone call wasn't the only possible action. What else could the security guard have done?

Even before placing the phone call, he could have asked both of the pair to show some kind of picture identification; they drove to the plant, so at least one of them should have a driver's license. The fact that they had originally given phony names would have been immediately obvious (a professional would have come equipped with fake ID, but these teenagers had not taken that precaution). In any case, Leroy should have examined their identification credentials and written down the information. If they both insisted they had no identification, he should then have walked them o the car to retrieve the company ID badge that "Tom Stilton" claimed he had left there.