Kevin Mitnick

1 card

1. 01

   The most expensive defensive technologies are useless if the attacker gets in through people rather than machines; the weak link is the human persuaded to cooperate.

   The Art of Deception · 2002

   The most expensive security technology breaks through a person who willingly grants access.

   Mitnick, a former notorious intruder turned consultant, argues that most serious breaches exploit trust, not technical flaws. The mechanism is social engineering: a caller who sounds like a colleague from IT asks for a password, an email that looks like it comes from a manager asks for a transfer. Technical defenses see nothing, because there is nothing to break into; access is simply handed over. The classic example in the book: an attacker calls the reception desk, poses as an employee who forgot his credentials, and receives the data within minutes. The practical conclusion is that training people, verifying identities through procedures, and a culture that permits refusing and double-checking matter as much as any equipment.

   “Companies spend millions of dollars on firewalls, encryption, and secure access devices and it's money wasted because none of these measures address the weakest link in the security chain: the people who use, administer, and account for computer systems that contain protected data.”

   Open the card →