In This Part:

Attacking the People Layer

Black-hat hackers attack computers, because that s where company information is. But, can this information be found somewhere else? Where can attackers get information that isn t protected by firewalls and Intrusion Detection Systems (IDSes)? The answer is: people.

By some estimates, 80 percent of a corporation s knowledge resides with its employees. This helps attackers in two ways: 1) employees have a treasure trove of information; and 2) humans are easier targets than computers. The stereotype of technically proficient attackers is that they have poor people skills; however, that is not always true. One of the most notable, Kevin Mitnick, is personable and outgoing. Kevin is a proficient technician; however, his technical abilities are exceeded by his skill at manipulating people. For some, the anonymity of attacking a computer feels safe; however, the social engineer is more comfortable getting what he or she wants from people.

Corporations aren t the only targets of attack for obtaining illicit information. Identity theft involves getting enough information about a person to be able to impersonate him or her convincingly in order to use his or her credit cards, or to obtain new credit cards and loans in his or her name. Identity theft is performed both offline and online.

At a privacy conference, U.S. Federal Trade Commission chairman, Timothy J. Muris, said, Whatever the...