As someone who runs a security consultancy, I can agree. Strangely, the article seems to frame even Mitnick's admission that he's nothing special in a mysterious light:

> And here’s probably the most interesting fact: Mitnick and his constantly changing team of speciality hackers have a 100 percent success rate. That’s no legend. “It’s not even bragging,” he said. “It’s just a fact.”

Yes, me too. Same with almost every attack crew worth their salt. It's possible to be protected from known vulnerabilities and misconfigurations, and it's even possible to train your employees to never perform dangerous actions or disclose sensitive information... but it's very, very difficult.

The best defense, really, is just making your attack surface as small as possible.

I've always been curious how one applies as a social engineer or hybrid SE and tech guy for a security consultancy. It seems like something that I'd really enjoy doing (having never done it and also not having particular great people skills). I don't know how the business works at all but I'd love to be a plant at some company (or a fake customer) to test their security from the inside.

It's not something you can easily learn on your own (I'd guess).

Since I worked in ERP I'd also be pretty interested in security testing business software. I can see a myriad of issues both technically but also on a human and for lack of a better word "process exploitation" level.

If anyone has suggestions on writing a job application without any actual security testing skills I'd be interested in hearing them. Basically all I can think of is "I know some technology and can program, I have some business background (specifically ERP), I think I'm a quick learner and I'd probably work for very little assuming increased salary as I get more valuable"...sounds like something I'd instantly put in the trash if it hit my desk though :P

Same here, as in being interested in the field.

On the other hand though, I've had something like 10+ customer service jobs, along with formal education, a tried-and-true love of technology...and a deviant / mischevious streak wider than the Gulf of Mexico. Oh, also acting lessons...People are kind of my specialty...

To me, working customer service is very much a social engineering training ground. How? Little to no actual authority, frequently hostile / challenging engagements, and limited tools and techniques by which a solution or conclusion can be reached. There's a significant advantage to out-thinking one or more customers, staying just ahead of them thought process wise, which seems to align with turning the coin around.

One of the other things I learned through both customer service and in my white collar career(s) is how to dress for success. Self-presentation is one of the most important parts to get people to let down their defenses. Technicians look tech-y, consultants look business-y, security people project a certain firmness...well, anyway, that's been my experience as both service provider and dealing with people in power. I've always used my learned perspectives for good.

At the end of the day, it's absolutely amazing the results that one can get with a pleasant, persistent attitude, good appearance, and some patience.

We had a guest lecture from a visitor who worked for a penetration testing company. It was surprising how easy he described (in person) social engineering to gain access to privileged areas and information to be. I can imagine that's one of the hardest areas to defend, especially when some companies have so many potentially vulnerable members of staff.

If only social engineering were engineering; maybe I'd be better at it.

When a pen-testing company has a contract in place with their client absolving them of any fault, it probably makes peoples confidence in carrying out social engineering (and not getting caught) much greater.

Usually, you will not get completely indemnified financially. Legally, though, yes. Having a green card to do physical testing is a lot of fun. Some of the time the police do get called or whatever, I have stories. But, the short version is.... nothing happens. You have contacts high up at the company. You have a contract. It spells out you will be doing these things. You usually get paid some amount up front. It's enough to not worry about it very much and just do your job.

That makes total sense. I've read a few of Mitnick's "Art of" books and the l0pht story is really in line with that.

One technique that I found to be extremely useful, personally, is a "purposeful intellectual slowdown" with the express purpose of discovering just a couple personality traits that would lead to an exploitable route. As in, does this person like to laugh? Are they all business? It's a lot easier in person, but I've got tons of hours of phone practice through honest work that has honed the skill quite a bit. Once you find the "in" then it's easier to ramp-up the goal pursuit!