How to spot a corporate spy

Con artists make it their job to extract sensitive corporate intelligence from unsuspecting employees. Here's how to stop them.

>>> How to stop them: Employee awareness goes a long way. "Most organizations don't even remotely invest in staff awareness," Winkler says. "Most people seem to assume if you're in the building, you must be OK, and that's a presumption that criminals rely on. You need to have standards for what is and isn't appropriate and then reinforce that with a mind-set of challenging people who don't adhere to those parameters."

A second line of defense is to use protective tools like screen savers with password controls, and to encrypt data and require strong passwords for employees with liberal access rights, such as IT administrators and C-level executives. "Most networks are poorly protected," Wood says. "We see trivial, stupid passwords in every firm we visit. Often, the password is the same as the account name."

Finally, classify information in terms of how valuable it is and store it accordingly, says Wood. Even by applying encryption and password controls to just the accounts of IT administrators and senior staff members, companies could solve 70% of the problem, he says. "It would make [accessing information] so much more difficult that it would be a major accomplishment," says Wood.

Posing as a Visitor

Another way of infiltrating a corporation is by posing as a legitimate visitor, such as a telephone or electrical maintenance person, a burglar-alarm inspector or someone from the fire department checking smoke detectors. Wood says he creates convincing costumes by purchasing a fluorescent jacket and work boots and downloading iron-on logos from the Internet. "The whole thing can cost $7," he says, which goes to show how useless physical credentials like business cards are today. Some things he has found while walking around buildings posing as a visitor include customer account details, payroll data disks, a voice-mail guide with default passwords, information about spending on advertising, bank statements, a staff directory, and whiteboards covered with notes about corporate strategy.

>>> How to stop them: The identities of outsiders seeking access to the building must be verified with more than ID cards, Wood says. An employee should ask a visitor to identify his employer, and then the employee should verify the information on the Web and follow up with a phone call to the company to ensure that the visitor is legitimate. "It's tedious but necessary," Wood says.

Persistence pays. Once, when Winkler was posing as a person from corporate who needed a tour of a facility, he was interrupted by a manager who asked why he was being shown around. Winkler gave him a West Coast phone number. "It was 8 a.m. on the East Coast, so by the time he could reach anyone, I was out of the state," he says.


As defined by Wikipedia, phishing is a form of social engineering in which spies use a collection of techniques to manipulate people into releasing information (such as passwords) or performing actions that compromise confidential data, such as clicking on a link that enables someone else to remotely control a machine. In fact, the SANS Institute identifies phishing as one of the biggest Internet security risks.

For example, a spy might call the help desk from a pay-as-you-go mobile phone, claim to be working at home and request that a new username and password be sent as a text message to his phone. And some spies employ what the SANS Institute calls "spear phishing," in which they send individual employees highly targeted e-mail messages that include specific information designed to make the messages look genuine. For instance, a request for usernames and passwords might appear to be from the head of human resources.

>>> How to stop them: Wood suggests training staffers to be cautious and giving them tips on how to detect social engineering. For instance, he says, they should withhold information when callers act rushed, drop names, use intimidation, ask odd questions or request forbidden information. There should also be clear policies as to how to report an incident and to whom.

The SANS Institute says it's important to continually raise employee awareness of these techniques, perhaps through drills that involve mock phishing attempts. Companies should also avoid exposing too much information on public Web sites, including logos and employee e-mail addresses.