In personal conversations on the phone or by e-mail, many employees are willing to disclose far more information than they would in a letter or if more people were present. Furthermore, the identity of a communication partner is usually not questioned, as this is perceived as impolite. In the same way, permissions are often not sufficiently checked; they are implicitly deduced from a contact's (purported) role instead. An employee can receive an e-mail from someone claiming to know their supervisor, who has agreed to the urgent transfer of an outstanding sum of money. A stranger wearing work clothes and carrying a tool box may also be granted access to a data centre after mentioning something about "water pipes".
- BSI -
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)