Applying persuasion to information security

Social Psychology Professor Scott Plous mentioned a very enlightening almost 12-minute video on the "Science of Persuasion" by Robert Cialdini and Steve Martin.

Every security professional should be able to persuade their customers and users in an ethical and successful manner. I recommend to watch this video. For those who can't or who won't, here you are some learning points:

6 decision-making shortcuts or principles that govern human being's reactions and influence:

1. Reciprocity
In general, we feel obliged to answer back with kindness when we are the receivers of a nice act.

Cool tip from the video: If you describe your action while being kind, you are the first to give and it is personalised, then the reciprocal answer is even better. The statement "For you, nice people, here's an extra mint!" in the video corroborates.



2. Scarcity

Simply put, human beings like to have more from what becomes scarce. If it is not scarce, then we do not have such a big interest. So, if you would like to sell your security services, tell your customers about your unique value proposition! 



3. Authority
People follow the view of experts. Transposing the example showed in the video to the security world, if you display your security certifications, or even tell someone (even if they personally also benefit from it) to market your great professional value, your customers will follow your advice a little more seriously.

This principle has also a curious application: people get more persuaded by people wearing uniforms. Take this into account in your next social engineering engagement.


4. Consistency
People like to be consistent with previous decisions they took. This is the reason why some of the big requests are preceded in time by small enticing related requests that are far easier to be accepted.

Voluntary, active, public and, if possible, written commitments do wonders. I think this is really underused in our information security arena.



5. Liking
"Human beings prefer to say yes to those they like". Important point: Who do we like? According to Robert Cialdini and Steve Martin we like people who are:

- Similar to us.
- Complimenting us.
- Cooperating with us.

Simple but powerful facts. The most important tip then: If you are bound to negotiate security measures with a customer, talk to them first in an informal manner to identify similarities, to compliment them and to cooperate with them.


6. Consensus
In general, we do not like to be the exception. Mention what other similar customers are doing. A way to apply this to our field could be showing reputable statistics on the adoption of specific security measures.

Channelling attention to persuade ethically

Happy ethical (and costless?) persuasion!

A new lecture by Robin Dreeke on Social Engineering - Earning trust

In the past February 2013, the Social-Engineer.org crew interviewed again the behavioural and rapport builder expert Robin Dreeke. The podcast can be found here.

Robin Dreeke shared in this interview some input coming from a new book related to trust and empowerment. Here you will find a very personal set with some of the points he mentioned:

Empathy foundations

 - The three key questions to ask in an input-gathering conversation are how, what and why.
- Dopamine goes to our pleasure centers - our brain rewards us then.
- Getting our interlocutor to get their brain rewarded by you talking to them should be our goal.
- It is important to understand context. How can we adapt ourselves to understand their way of being?

The tribe

- We need to understand the tribe mentality.
- When we are part of a tribe, it means survivability.
- Our ancestors had the need to belong to a tribe.
- Our brain rewards us when we feel part of a tribe.
- We could use DISC to identify communication styles.
- How do we do it quickly?

Make it all about them from the psychological viewpoint

- We should not memorise anything we are planning to say.
- Proposal: Use sympathy and an artificial time constraint.
- We can practise sympathy e.g. help me find a Valentine’s day gift for my partner.
- Our conversation would identify direct individuals (people oriented persons).- If they get us to do most of the talk (then they are passive).
- Just by analysing the way they dress they will tell us whether our interlocutor is people-oriented or indirect, task-oriented or analytical.

 Demographics and culture

- One very simple technique - the easiest listening technique is have nothing to say - shut up!
- Key point: We want to validate them, we need to be focused on what they say, so shut up!
- The second we need to say something, we need to discard it!
- Example of input-gathering sentence: “I had a similar experience, tell me about yours”.
- If necessary, we can give a little bit of info but let's remember it’s about them.
- People are constantly testing how much we will accept them, if we accept them, they will tell us a little bit more about them.
- We need to become that person that will accept them unconditionally.
- We need to control our non-verbals so that we don’t reveal that we are judging them.
- It is almost as if we turn the conversation into a science experiment about people.
- One step further would be how did they decide to dress that way?
- Our focus will influence our approach, we want to know why that person
made some decisions.

Curious people

- What do we do with people who keep on asking questions?
- This is a validation coming to us.
- We could bounce it back and be conscious of the information we are giving away.
- If it keeps coming back to us, we'd better cut the engagement.
- Internet based social networks - people are constantly seeking validation - that is why people have thousands of friends e.g. in facebook.

Job interviews

- In a job interview, we'd better put in context how we can help them and their company.
- Currently, given labour market limitations, we could go back to a time constraint, e.g. "let’s run a contract o three months and you test me".
- Become fascinated about people.
- No one will hire us because of us but because of the benefits we can bring to them.
- Feel the emotion behind what you are saying.
- Positive psychology - be happy with what you are doing now.

Getting closer to the empathy palace

Happy empowering 2014!

Human intuition: What if we apply it to improve security?

Within the @Google Presents talk series, the Nobel Price and psychologist Daniel Kahneman gave a lecture on intuition that I summarise in this post, always looking at it through the information security lens to distill innovate knowledge.

He started with an enticing question:

Intuition, why do we magically know things without knowing we know?

Different authors have studied human intuition. Gary Klein in his book on "Sources of Power: How People Make Decisions" think that judgement biases are not so negative. Malcolm Gladwell, in his book "Blink: The Power of Thinking Without Thinking" has also dealt with the power of intuition.

Mr. Kahneman is sceptict about expert human intuition. For example, in fields like Medicine, when can you trust intuition? He identifies two modes of thinking that lead to the creation of judgements:

- Mode A, as something that happens to us, e.g. when we perceive through our senses, have impressions and intuitive thinking. This is the intuitive and automatic one.
- Mode B, as something that requires effort. This is the deliberate and 'effortful' one.

He shares some scientific results that can have an impact in social engineering: self control related to mode B is impaired if we are doing another activity at the same time. This means that it takes some effort to control our impulses. For example, we would pick chocolate more easily if we keep at the same time a 7 digit number in our head (minute 12 of the talk).

Would that mean that if we ask someone for their password while they are doing an 'effortful' activity we could be more successful than if we ask them when they are idle? Probably.

However, if we focus at mode B, for example, driving is a skill. In a mode A skill things begin to happen automatically: we can drive and talk, we would brake in a completely automatic manner. The same cannot be said, for example, if we drive on skids. This is a completely non-intuitive skill.

But then, when can you trust intuition? Mr Kahneman states that, if there are clear rules in the environment, especially if those rules can give us immediate feedback, we will acquire those rules and let mode A run. This is the reason why we are very good at immediate reinforced practice. This is what he calls intuitive expertise: the reason why, in Medicine, anesthesiologists, thanks to the quick and good feedback they receive from their actions, develop intuitive expertise and the reason why radiologists get the opposite case: they receive slow and not so good feedback from their actions so they have a difficult time to develop intuitive expertise.

Let's have this point in mind when we approach a user community to improve their security practices.

This expertise is not possible in chaotic scenarios. This is why the world is not predictable. For those cases when predictability is poor, it is better to follow pre-made scripts.

This thought is valuable when designing incident response actions. Build your formula and don't let intuition be the main driver. 


Peculiarities of our mind

Mr Kahneman mentioned that human memory is superb at remembering routes through space but rather poor at remembering a list. An practical example of this can be found in the book "Moonwalking with Einstein" by Joshua Foer.

So what about if we associate places in our work facilities with secure behaviours?

Our mind likes to think about agents that have traits and behaviours. We are not good at remembering sentences with abstract subjects. Our behaviour is influenced by the signs and posters that we see around us. Especially by those that relate to something concrete. For example, when people are exposed to a threatening word, they move back. Symbolic threats have a real effect.

And what about if we place a poster with a pair of eyes watching us close to an Internet kiosk in a public place in a firm? Would users behave more securely?

Our mood is also influenced by our actions. If we make a smiling face, we are more likely to think that things are funny. If we place a pencil in our mouth, we will think that the cartoons we watch are funnier.

By partially activating ideas through these mechanisms e.g. by whispering words, then the threshold to feel emotions related to those ideas is lower and all this happen without us knowing it consciously.

This has a lot of potential at the time of designing a cultural change related to information security at workplaces.

Our associative memory is a repository of knowledge. We take very little time to create norms in our minds. Our reasoning flows along causal lines, this happens intuitively. The coherence that we experience can be turned into a judgement of probability. This is the reason why Mr Kahneman is not really a fan of human intuition: People have confidence in intuitions that are not essentially true.

This point is key for those applying risk management methodologies to their information security practice.

He mentions that, so far, all intelligence tests we have are for mode of thinking B. However, we are all influenced by our intuition. It's hard work for mode B to overturn what mode A tells us.

I finalise this summary with the 'security related' morale of the talk. When can we trust our intuition? Only when the environment is predictable and we have had the opportunity to learn its regularities.

Happy intuitive reading!

Were these the posters in the Middle Ages?

Surviving success in entrepreneurship and... in IT security?

Stanford University shares with everyone on the Internet a series of podcasts and videos related to entrepreneurship through their Entrepreneurship Corner. These pills of knowledge are not intentionally related to information security. However, I find that the learning points mentioned there are worth at least some reflection time by itsecuriteers. For instance, Mark Forchette presented his talk on how to survive success. I drew some lessons from his talk:

lesson 1 - know what you want, set your objectives, promise you will achieve it

lesson 2 - you must have passion

lesson 3 - no matter what you do, you must know how to sell, everybody sells

(proposal of a book to read : how to master the art of selling)

lesson 4 - there is no failure that you can't recover from (so enjoy failures)

lesson 5 - strategy and tactical implementation = success (if you cannot execute the plan, it's not worth the paper it is written in)

lesson 6 - the most dangerous thing in the world is a past success you are still in love with  - surviving success is one of the most difficult things - the best day has to be ahead of you

lesson 7 - do things other than just for money

lesson 8 - people do business with people they like - business is a contact sport - be likeable

lesson 9 - prepare, prepare, prepare

lesson 10 - make sure the right people are on the right seat

Look at these 10 lessons from the IT security practitioner viewpoint. They can provide you with value.

Happy entrepreneurial reading!

Learning to fly

Robin Dreeke on building rapport - A new pill of wisdom from the SE podcast

The Social-Engineer.org crew always provide really useful information on human behaviour. This time I highlight a podcast about how to build rapport, where they interview Robin Dreeke, FBI agent specialised on these powerful topics. If you have 77 free minutes, listen to the entire podcast. If you don't, at least browse through the bullet points below, they are a very personal summary of the interview (some topics repeat themselves given their importance).

• Building rapport: You can't fake it. It needs to be real (minute 20).
• Stay within reality, send a congruent message with your words and non-verbals (minute 20).
• How to defeat anxiety and stress when talking in public? Think that you are doing it to help a friend (minute 21).
• Pre-text yourself: Offer something that your audience (or your interlocutor) would enjoy and like. Imagine they are your friends and you would like to share something with them. Be ready to trigger a good feeling in them (minutes 22 and 23).
• Focus on making your interlocutor feel very well while you are pursuing your goals (minute 23).
• Key aspects to consider when talking to someone: Don't try to impress, suspend your ego, downplay yourself, use the technique of sympathy to elicit help and reciprocal altruism (minute 25).
• Make a quick smile, a quick glance and then glance away. Don't stare at them! (minute 26).
• Keep your tempo slow, don't over speak, don't over sell, be confident but remember, you are seeking help (minute 27).
• Appeal to their sense of humanity, seek help, seek their opinions, let them know that you value their opinions, make them believe that they are experts on their topic, open up to them (minute 28).
• Get people's shields down by talking about dates and birthdays. Prepare your pocket of things about yourself and share it with them. Once you are done, they will open up to you (minute 32).
• Send out an artificial time constraint, verbally or even better, non verbally (e.g. talk to them over the shoulder - talking at an angle, your feet and hips should be pointed like your are going to leave, keep the chin a little bit down and mention that you only have a few minutes - minute 33).
• Start threading on the context they give you as a response. Be patient.
• Accept people for who they are and validate their choices. Don't be judgmental. Don't pass judgement. 
• How to do it when you don't agree? Be fascinated about them. Try to understand every aspect of their answer. Answer with "what an amazing thing you did!".
• Constantly practice all the time, it is a muscle you need to train (minute 39). Talk to a stranger every day (get a little adrenalin rash).
• People love talking about themselves. People don't care about you (hard but real fact).
• Never argue with someone you try to social engineer. Ask them the question to them and let them answer.
• Let the people filling the thoughts, the gaps in a conversation for you. Silence with little non-verbal confirmations are great.
• Every generation has their own nuances.
• If you don't have kids, reflect about friends who have them or even your own experiences when you were a kid.
• If your interlocutor has a bad day, validate them and offer your help. People will start opening up (minute 49).
• If you appear threatening, make a little joke and refer to that appearance in a critical way. Upper your chin a little bit.
• People love the fact that you are trying to accommodate them.
• As soon as you say "hey, I am not a bugger", people will believe. People take you at your face value.
• Most people will go out a long way not to lie. Lying is a very uncomfortable thing to do. People generally don't want to lie.
• Reciprocal altruism: Never try to impress but seek help. People are willing to help.

Thanks again to the Social Engineer crew!

Sides of human beings

Tweet this post to those in need of building rapport ;-)

Book review: Social Engineer - The art of human hacking by Chris Hadnagy

I wanted to post a personal review on a current social engineering reference book. Christopher Hadnagy's book, "the art of human hacking" deserves the label of reference book in the social engineering field.

I enjoyed reading the book. Those who listen to the social engineering podcast, in which the author takes part, will find in the book most of the topics dealt in the first 20 something podcast episodes. This book is the written witness of the spirit present in the social-engineer podcast.

SE book highlights

In this post, I fly over, following a very personal route, the main ideas that the 9 chapters of this book contain. The book is easy to read. Every chapter conveys some summary points plus a brief summary at the end. This facilitates the identification of the learning points.

The lessons learnt are applicable in almost every aspect of our lives. By no means this summary aims to replace the reading of the book. On the contrary, this is a book I recommend to read, not only to information security professionals, but also to anyone interested in knowing how human beings tick. This book is a valuable tool when modelling human behaviour. Actually, if there is intelligent life in outer space and they need to liaise with humans, this is one of the books that they need to read so that they can understand humans.

chapter 1 - introduction to social engineering
This first chapter describes the different types of social engineers. Interesting point: governments are also social engineering actors.

chapter 2 - information gathering
Chapter 2 mentions information gathering tools like BasKet and Dradis. There are also two telling examples, the USB example mixed with an encounter in a cafe and the stamp collector story. Some points that I highlight are the following:

• Interesting their message that every one can have and have different personal realities (page 44).
• Most of the time people want to help (page 52).

chapter 3 - elicitation
Elicitation is non-threatening and it is very successful (page 58). It is eye-opening to know that a simple light conversation is all it takes to get some of the best information out of many people (page 58).This chapter mentions the intricacies of elicitation, such as how preloading the target with info or ideas on how we wanted them to react to certain info is a good start (page 62). They mention an example related to "how to convince your partner to go for dinner to a steak house" (page 62) - it is worth-reading it - would that really work?

A basic way of elicitation is to start a conversation with "I would like to tell you a really funny story" (page 63). 

The author also mentions the concept of preloading. From an social engineering (SE) viewpoint, "preloading involves knowing your goals before you start". Expressing a mutual interest is more powerful than appealing to someone's ego: another important learning point (page 67). More information on elicitation can be found in the social-engineer.org site.

Some of the elicitation techniques that the book mentions are:

• Appealing to one's ego.
• Expression of mutual interest.
• Deliberate false statements.
• Volunteering information.
• Assumed knowledge.
• The effects of alcohol (not a different technique but equally effective).
• Open ended questions, what do you think of the weather today?

Let's define some concepts that the book presents:

• Elicitation is the process of extracting information from something or someone. Read the definition on the social-engineer.org site.
• Pretexting is the act of creating an invented scenario to persuade a targeted victim to release information or perform some action.
• Preloading is influencing subjects before the event. Think about a movie's pre-release trailers. They use desired outcome words such as “The best film you have ever seen!” This technique works great when introducing anything. Preloading is a component of a social engineer attack.

Some of the techniques the author mentions are:

• Use open-ended questions to obtain detailed information (page 70).
• Closed-ended questions are appropriate to lead the target to a goal (page 72).
• Asking people a leading question in order to manipulate their memory (page 73).
• Assumptive questions - you need knowledge before hand so they need to be used with care (page 73).

chapter 4 - pretexting 
The ideas mentioned around pretexting i.e. creating the background story that makes up the character you will be for the social engineering audit, rotate on these points:

• On the Internet you can be anyone you want to be. 
• Create a scenario where people are comfortable with providing information they would normally not provide. 
• Practice makes a good pretext.
• Self-confidence is always related to a situation.
• Cognitive disonance: People have the tendency to seek consistency among beliefs, opinions and cognitions.
• Dialect - you need to master the right pretexting dialect - at least spend some time listening to people in public talking to each other.
• Play it back later (from the recorder) this is recommendable
• Use an outline script.
• Use sounds from e.g. thrivingoffice.com
• Do not try to make the pretext elaborate
• Keep yourself within the legal arena

chapter 5 - mind tricks
According to this chapter, we need to identify the target dominant's way of thinking. The author refers to Dr. Paul Ekman. He showed that emotions are universal across cultures and biological backgrounds. He worked with  basic emotions through the microexpressions that show those emotions. However, these skilled people could show those microexpressions in a different time.

This chapter mentions a possible way to overcome the client's reluctance to communicate: We need to identify whether they are a fan of sight, hearing or feeling (the site www.examiner.com is mentioned as a source of info).

We also need to try to identify deception by identifying contradiction, hesitation and changes in behaviour and hand gestures. Some of the NLP language patterns to influence change on interlocutors have to do with the voice tone (site mentioned: planetnlp.com).

There is also a general recommendation to watch for a group of signs and not only one sign to determine the baseline of our interlocutor. A set of leads on which we have to focus are microexpressions, body language cues, changes in verb tense and person use. An example of anchoring is linking a statement of a like kind with a certain gesture.

An valuable fact: People retain less than 50% of what they hear. As smart interlocutors, we need to react to the message, not to the person. For example, a way to state something could be "it sounds to me like you are" rather that using "you are" alone.

While practicing all these techniques, we need to develop a genuine interest and let the other person talk about herself until she gets bored of it. Let's remember that people's fundamental needs are:

• Love/connecting
• Power/significance
• Freedom/responsibility
• Fun/learning
• The effect of young star photos
• Breathe at the same pace as your target
• People like people who are like themselves
• Human buffer overflow = law of expectation + mental padding + embedded roles 

chapter 6 - influence: The power of perceptionThis chapter mentions concepts such as "kill them (verbally) with kindness", scarcity and concessions and again that 
simply asking the target a question can lead to amazing results. We can manipulate attention through the use of scarcity. Let's remember that people are driven to desire that which is hard to obtain.

Chapter 6 lists these types of authority:

• Legal authority.
• Organisational authority.
• Social authority (in western countries, clothing, cars and titles).

The author also describes the value of commitment and consistency with actions (e.g. people are more prone to help you when you leave a bag unattended if you previously ask someone to look after it) and some additional ideas such as:

• Liking (people like people who like them).
• People need to be liked, they change their behaviour to be liked by others.
• Good-looking people succeed more than not good-looking people.
• Humans attribute more good traits and skills to good-looking people.

chapter 7 - the tools of the social engineer 
We can read about lock picking, intelligence gathering using public sources, tools like Maltego, SET and password profilers.

chapter 8 - case studies: Dissecting the social engineer 
This chapter provides a valuable set of examples coming from the author and from Mr Mitnick himself.


chapter 9 - prevention and mitigation 
The bottomline: Prevention and mitigation creating a personal security awareness culture and the importance of developing scripts and being aware of the criticality of the information you are dealing with.

Happy social engineering!
Congratulations Mr Hadnagy!

Social-engineer.org crew interviews communication expert Joe Navarro

The episode number 14 of the Social Engineer podcast features an interview with the author and expert in non-verbal communications, Joe Navarro. This is a post with learning points extracted from listening to his interview.

Disclaimer: These lines do not substitute the listening of the interview. The statements mentioned are close to literal or slightly summarised or just a subjective interpretation. Kudos to the social-engineer.org crew!

Minute 17: Inmigrants in a country using a different language than their mother tongue need to be sensitive to body language and observe carefully.

Minute 18: Babies mimic gestures since their third week of life.

Minute 19: Babies with eleven months look for mood clues coming from their mothers.

Minute 20: Blue is a smoothing colour. Blue is predominant on TV.

Minute 22: When we see something beautiful, our pupils dilate. When we see something ugly, ours pupils contract. Our limbic system controls this.

Minute 31: A good observer focuses not only on the face but on the entire body. It is more difficult to lie when there is space among our fingers and we show our thumb.

Minute 36 and 37: People talking while looking at the same direction are more relaxed than people talking facing each other. Facing people create tension when talking.

Minute 41: You can calm someone down just by exhaling in front of them (they will mirror you).

Minute 47: A biographer of Kennedy mentioned that you can get anyone anywhere anywhen talk to you, you just have to tell them that you treasure their opinion.

Minute 55: The meaning of words: People in their fifties like to talk about problems, people in their thirties talk about issues. People like to talk with people like them.

Minute 66: When performing social engineering, assess whether the person does look comfortable to you.

Minute 66: In the US, the amount of time one should look someone else at their eyes is 1.8 seconds.

Minute 68: Arch your eyebrows when you greet someone. When arching the eyebrows, we burn sugar. We only burn sugar when we care. Babies respond to this action already when they are a week's old.

Minute 70: If you show space between your fingers, you are confident of what you are saying.

Minute 72: Some tips on using body language with your children.

Happy interview listening!

Social engineering lecture by Kevin Hogan

The episode number 9 of the Social Engineer podcast features an interview with the author and body language expert Kevin Hogan. Among other books, he has written "the psychology of persuasion". This is a post with learning points extracted from his words on persuasion. Here you are (most of them are close to literal, or slightly summarised, statements from Mr. Hogan):

Minute 17: Let's try to use the right words. Emotions are attached to words. The listening of some words (e.g. terrorist, malware) triggers, unconsciously, the release of cortisol and adrenaline in our brains.

Minute 22: "When people smile too much ...[]... we put a question mark".

Minute 23: Keep yourself a handshake's distance away in face to face communications (for liking and acceptance). A smaller distance calls for a negative answer from our counterpart. People tend to have an affinity for mirroring (e.g. same first name, same voice, same clothes): "The reason why I know he is a genius is because he thinks like I do" (min 25).

Minute 24: "Women really pay attention to shoes ...[]... women are really discriminative about men in general".

Minute 25: Identifying badges. If you want to pass unnoticed, leave all necklaces and unique accessories at home. And the opposite, if you want to be remembered, show that unique tattoo you have.

... for right-handed people... (for lefties, the sides mentioned will be the opposite)

Minute 26: Right-hand handshakes. In general, when you look up to the right, the left brain hemisphere is more active. And this side is more logical and sequential.

Minute 27: The right part of our brain is mostly biographical (and unconscious), full of unpleasant memories. Not recommendable to be highly active when we first know someone.

Minute 29: If you want to cause a right impression, sit close to the tidiest side of the desktop, which, in right-handed people, is usually the right side. Avoid the chaotic side of the table.

Minute 33: Sit down at ease and look with your eyes to the right. No problem! Look now to your left. Do you feel like ending with that look? And do you notice fear, sadness, anger?

Minute 36: Left and right. Generic statement: If you put your earphone on your left ear, you will have a more emotional conversation than if you place it on your right ear.

Minute 39: Microexpressions. Do not force a smile, they will all discover it. A phony smile creates discomfort (min 42).

Minute 42: Human beings look for simetry. "Simetry is easy to fake... by keeping your lips slightly apart". Keep this posture in photographs.

Minute 46: A look of curiosity opens more doors that a smile.

Minute 50: "Men are territorial". If a man sits close to a woman for longer than 5 minutes, he becomes her protector.

Minute 55-57: Access any facility appearing that you belong to it. "When trying to enter any facility, a cleaning man with a mop and a bucket is never stopped ...[]... or carrying the internal magazine ...[]... or carrying a company box ...[]... or asking for John".

Minute 57: "If you look angry, nobody would stop you [at the entrance]".

Minute 60-61: "Most people are in auto-pilot within their role". Keep them in auto-pilot within their role and your social engineer compromise would work. Do not raise any flag.

Minute 64: Most of the people would like to keep on being comfortable in their roles.

Minute 65: Reading an email. 50% of the content of any email you send is already on the mind of the reader. Emoticons could create a nice initial context.

Minute 67: "People are terrible at understanding risks".

Minute 69: If you need to obtain information, better than asking how are you, ask what are you up to?

Minute 72: The more real something looks, the more tangible and credible something seems e.g. a testimonial with a real name says much more than an anonymous testimonial.

Thanks to Mr. Hogan and to the social-engineer.org crew again!

Social engineering lecture by Dr. Ellen Langer (Harvard University) - Part II - Learning conditionally

The episode number 7 of the Social Engineer podcast features an interview with Harvard psychologist Dr. Ellen Langer. This is a second post with learning points extracted from her words on mindfulness. Here you are (most of them are literal, or slightly summarised, statements from Ms. Langer):

Minute 20: Expectations. Someone publishes in a newspaper an ad asking for a 1 USD banknote. He made a lot of money. Many people just sent the dollar. They were expecting something nice in return. Actually, our brain is wired to expect that.

Minute 21: There is nothing better to provoke rejection than stating: " What you have to do is..." We do not like to be told what we have to do. However, we welcome requests.

Minute 22: The foundations of manipulation rest on offering a choice to the interlocutor. The manipulator's task will be to guide them through the choice. E.g. "[adapted]...If you would like your child to have eggs for breakfast, just ask her how would she like the eggs and not whether she would like to have eggs for breakfast".

Minute 23: A second opinion does not matter very much. We associate the word second with something less important.

Minute 25: If you need 20 minutes from someone who is really busy, start asking something along these lines: "Could you devote me two hours this afternoon?" They will answer "No way". And then you introduce your real request: "What about you give me 20 minutes?".

Minute 28: The question determines the answer. Compare these two questions:
- Why am I a failure?
- Why am I a success?

Minute 29: Another example of framing, look at these two sentences:
- You are wonderfully spontaneous.
- You are terribly impulsive.
We refer to a similar reality but within different frames. People always try to confirm hypothesis.

Minute 35: The role of people in messages, especially in messages asking NOT to do something. Two cases:
- Keep off the grass.
- Ellen says keep off the grass.
We tend to follow de-personalised messages (first case) more than personalised messages (second case).

Minute 37: (Almost) everything we experience is the result of a previous decision. Once the decision is made, most of those decisions are accepted mindlessly.

Minute 39: Mindlessness maintains the "status quo".

Minute 45: Information has no single understanding. This statement can be applied to fight against stress. Stress is a way to understand reality.

Minute 47: Learning conditionally: "This could be a table rather than this IS a table".

As mentioned already in part 1, this content is excellent - thanks to Ms. Langer and to the social-engineer.org crew!

Social engineering lecture by Dr. Ellen Langer (Harvard University) - Part I

The episode number 7 of the Social Engineer podcast features an interview with Harvard psychologist Dr. Ellen Langer. I have noted down some learning points extracted from her words on mindfulness. Here you are the first ones:

Minute 10 - More than 50% of current attacks to information systems are done through social engineering (from the social-engineer crew).

Minute 12 - Most of us, most of the time, are not consciously "present", in a state of "mindlessness", i.e. we set our brain in a kind of automatic pilot.

Minute 13 - The value of "empty requests" and the power of the word "because".

If we go to an office and ask the question... may I use the photocopier? We will get a less positive answer than if we use the following question: May I use the photocopier to make some copies?

Minute 14 - By using common "cultural switches", such as ...may I use the photocopier to make some copies?.. communication emitters tend to produce in communication recipients exactly the "typical or common answer".

Applied to social engineering, this means that the social engineer needs to engage the victim into a "common and known routine".

Minute 15 - "When we are not there, we are not there to realise that we are not there" - A game of words to define mindlessness.

Minute 16 - An example of "mindlessness". Try this game: Ask someone next to you to add these numbers. Tell the numbers one by one...

- one thousand
- forty ... and she will reply 1040

- one thousand ... and she will reply 2040
- thirty ...and she will reply 2070

- one thousand ...and she will reply 3070
- twenty ...and she will reply 3090

- one thousand ...and she will reply 4090
- ten ...and she will reply...
... 5000 or 4100?




"When there is something familiar, we respond typically in a mindless way. The reason we do this is because we overwhelmingly seek certainty and certainly leads to mindlessness (...) We should be learning in a more conditional way" (Ms. Langer)

Thanks to the social-engineer.org site for this great podcast!

Happy April!