Can I borrow your swipecard?

Can I borrow your swipecard? […so we can add 2,000 new admin accounts to your system] This case involves an accountancy firm based in South East England.  The firm had just lost a big client and as a result had to make some cuts which included letting a few members of staff go. Jamie had […]

Stay calm and (don’t) pay the hackers

Stay calm and (don’t) pay the hackers This social engineering case study highlights how attackers can use curiosity, urgency and fear to manipulate victims into breaking company protocols and get a finance employee to willingly transfer £152,000 into the attackers bank account. Miranda worked in Finance for Troy Ltd.  One morning she received an email with […]

The enthusiastic law student

The enthusiastic law student This case involves a law firm based in the south of England.  The firm was of a reasonable size and, like most law firms, held a lot of very sensitive customer data. One morning one of the solicitors received a Facebook message purporting to be from a young law student.  The […]

Criminal Justice Evolution podcast

Patrick Fitzgibbons was kind enough to invite me on to his US based Criminal Justice Evolution podcast.  We talked about the social engineering threats facing businesses worldwide, how cyber-crime is evolving and the difficulty law enforcement faces when tracking down cyber criminals.  There are also some excellent tips on how to protect yourself from this […]

The not-so-secret life of boarding passes

The not-so-secret life of boarding passes Another reason why posting your travel plans all over social media could put your security at risk.   Have you ever thought about what your boarding pass might say about you? I don’t mean “oh look at me, I’m flying in Emirates Business Class”, but what data you might […]

Podcast with Jenny Radcliffe -The Human Factor

I recently recorded a podcast with social engineer Jenny Radcliffe as part of her long-running Human Factor Podcast series. We had a broad-ranging discussion from pentesting to social engineering as well as tips for getting onto the speaking circuit. Here’s the link to the podcast: http://jennyradcliffe.com/episode-42-lisa-forte/ Jenny has interviewed many interesting people over the years, […]

Permissions Creep

Internal threats can be a huge threat.  One things that often ends up happening is something known as permissions creep.  Here’s how it works: Let’s imagine you have been hired by a company to maintain one of their buildings, building A.  So on your first day they give you the keys to building A.  You […]

What the prisoner’s dilemma can teach us about cyber intelligence sharing.

Cybercrime is increasing year on year. The 2017 cyber breaches survey shows that almost half of UK firms have been hit by cyber breach or attack in the past year. Yet for private companies there appears to be a severe reluctance to share cyber intelligence and vulnerabilities on platforms such as CiSP (Cyber Security Information Sharing […]

Equifax puts in strong bid for most catastrophic data leak in history.

In the latest in a truly blockbuster year for data leaks, American credit reporting company Equifax has announced the loss of highly sensitive data belonging to 143 million Americans. Nearly half the population of the US are thought to be effected. There have been much bigger breaches, but not with this quantity of sensitive information. […]