Page 166 - CISSO_Prep_ Guide

power of social engineering. There are several forms of social
engineering, including Name-dropping, Intimidation, Appealing
for help, and Technical.

Name-Dropping

Name-dropping is used to convince an employee that another
person has authorized them to do something for the supplicant.
For example, a person calls up to an administrator and states that
the administrator's boss has authorized the supplicant to have
access to a system or network and said that the administrator
would set this up.

Intimidation

Intimidation is the act of threatening a person to commit an
unauthorized action. This is often done by threatening to
escalate to a manager, threatening the job of the employee that is
not willing to break the rules or even threatening the family of
the employee.

One of the reasons that this is so successful is that many
managers also do this and expect a different form of treatment
than other staff gets. For example, a manager may not think that
they have to show or wear an ID card to obtain entrance to a
facility. A person that would challenge the manager to show
their card would be at risk of losing their job. Such action
creates a fear that can be exploited by an imposter that claims to
be a manager and, therefore, is affronted that anyone would dare
challenge them.