Combating Pretexting
Lifehacker had a link to an article on Wired News regarding some good ways to prevent pretexting.
We’ve talked about pretexting before. It is essentially the practice of pretending to be someone you are not to get information you’re not supposed to have.
Now, I didn’t like everything on the list (like getting a disposable cell phone – too CIA for most people), though I decided to highlight some areas that are easy and effective.
Normal people like both things – and security is no different. If you want security to be adopted by your users two basic premises are important:
- Easy for people.
- Effective (that’s the one important for us security folk).
Too often we get the “easy” part but not the “effective” part.
My favorite pretexting defenses taken from the Wired News article:
Shred It.
Cross-shred documents that contain personal information before discarding them, and do not leave such documents lying around where maintenance workers and visitors can see them.
A decent shredder is pretty inexpensive these days – and very effective.
Leave Your Vital Stats Offline.
Do not publish your birth date or other personally identifiable information about you or your children on your MySpace or Facebook page.
This is free.
…guard personal information such as Social Security numbers, birth dates, account numbers and passwords to prevent someone from using the information to impersonate you and obtain your records.
To that end, don’t provide personal information over the phone, in an e-mail or in person to anyone unless you initiated the contact. Even then, be guarded about providing legitimate agencies with more information than they need.