should say "grifted his dream car"
A man was gifted his dream car by Kevin Mitnick, who he helped put in prison
171–173 of 173 posts
Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison
#172I worked at a company that had hired Mitnick as a security consultant. His report for a client that turned out to have been rife with SQL injection at the time was largely movie plot physical security stuff. Not wrong exactly, but not the center mass of the threat model they needed either. He seemed to lack systems thinking, producing a report that focused on calling out specific employees as dumb or incompetent. Cou…
The hero worship of him makes me physically ill, always has. He did cost people their jobs though, so I guess he's a good person.
Being incompetent didcause people to lose job which required certain level of competence.
Job they shouldn't have in fiest place.
Social engineering is just that, exploiting people having insufficient intellect for the job.
Re: A man was gifted his dream car by Kevin Mitnick, who he helped put in prison
#173Earlier quoted context omitted.
Yeah, this is a part about itsec I don’t understand in my firm. They run social engineering tests, but never notify management when individuals fail, only in general terms. While being psyopped needs to be activelly discussed among coworkers imho.
That's because susceptibility to attacks is a question of training. What would the goal of placing individual blame be? Shame? Drive them to seek training outside work? Further, if you periodically single out people, the organization will hate you.
Regarding shaming: A new strategy I've noticed recently is that my organization randomly deploys emails from time to time that are basically "fake" hacking/phishing attempts. Sometimes it's a PDF link, or a request for an invioce, need a phone call, etc.
If you fall for it (clicking the link) then you get sent to a webpage saying "Hey this was a test and you fell for it... think twice before you fall for this again. Please watch this short security video". Then you get followup emails until you finally get around to watching the video.
Something tells me if you are a frequent offender they have you do additional training.
As annoying as the emails are, I appreciate that this avoids the shaming aspect. Its important to keep the normies on guard against this kind of stuff. And this gets the job done without drawing attention to human level failures. And it keeps everyone a little more on their toes.