And still more...
Posted by Lance Koonce
Our afternoon keynote speaker at the IAPP Privacy Academy was Kevin Mitnick, of hacker fame, who spoke on social engineering as the gravest threat to corporate security. Kevin's talk was quite engaging, in particular because it was interspersed with real-life examples of social engineering scams that vividly demonstrated his theme that humans are always the weakest link in any security system.
To the extent there was any weakness in Kevin's talk -- and he would probably admit this -- it was a scarcity of practical solutions to the social engineering problem. As he noted, there simply is no download patch for stupidity; i.e., correcting mistakes that are caused common human fallibilities is extremely daunting. Since social engineering preys on gullibility, overconfidence and the natural tendency to trust others, the only permanent solutions are education and awareness.
