Social engineering petrie dishies could easily be more secure
Monday, November 24th 2008 @ 6:02 AM (not yet rated)
Originally posted - May 9, 2007
On occasion, I am struck with how unaware the management in some industries are of the number of risks they face in everyday situations. Take the hospitality industry. In between client meetings I sometimes look for a quiet, comfortable place to sit and do email or finish some work. Hotel lobbies are one of my favourites. I’m sure many business travellers would agree with me.
Within a 30 minute timeframe the other day in a hotel lobby, I made quick notes on every conversation the hotel staff around me were involved in while I was working. Given that I was sitting within earshot of the front desk, but 30 feet away, there were several revealing tidbits I was able to overhear.
Here are some of the types of information that was easily overheard from across the lobby:
The last names and room numbers of several guests checking in, and sometimes their company name or affiliation
- Customer preferences, such as which room number a named guest must always have when he/she visits (as discussed between staff members)
- Supplier issues and names of contacts within the supplier and the hotel for certain responsibilities
- The best and worst employees, as identified by staff and guests
- Screw-ups in bookings of groups between hotels
- Hotel facilities and their locations
I’m sure there are many other types of information I could have learned if I stayed longer.
While some of these things are not necessarily considered sensitive information, they make it easy for attackers to put together plausible scenarios that give them access to information and places they shouldn�t have. It struck me that the staff sometimes get so bored, they have nothing else to talk about except guest incidents and how they handled them. While it seems innocent enough, it is a fertile ground for social engineering, data gathering, identity theft.
What could be done? Two things I immediately thought of, but I�m sure there are more:
- Segregate the front desk from public seating or waiting areas with sound barriers that make conversations more private.
- Train the staff to keep their voices down when discussing business issues in the open areas, on the phone or near other guests
Let me know if you have any other ideas of ways to better manage this kind of risk in the hospitality industry.
| Share | My live security awareness webinars are a quick and affordable way to provide your entire staff with professional quality security awareness training and education - whether it's general training or for specific teams or industries. I offer group rates and can tailor content to your specific needs. Please call or email me at the coordinates below, or CLICK HERE to see my training webinar catalog.
Scott Wright
The Streetwise Security Coach
Join the Streetwise Security Zone at:
http://www.streetwise-security-zone.com/join.html
Phone: 1-613-693-0997
Email: scott@streetwise-security-zone.com
Twitter ID: http://www.twitter.com/streetsec
To receive weekly security tips and other notices about helpful content available on this site, please make sure you are on my list by clicking HERE, and entering your name and email address.
 |
