Workplace smoking bans may be good for workers’ health, but could open the back door to hackers.
In a recent social engineering test undertaken by UK-based security consultancy NTA Monitor, a tester was able to easily gain access to a corporate building through a back door that was left open for smokers. Once inside, the penetration tester was able to easily bluff his way into a meeting room, claiming the IT department had sent him. Even without a pass, he gained access unchallenged and was then able to connect his laptop to the firm’s VoIP network via a telephone connection point.
NTA Monitor technical director Roy Hills comments: “It used to be that companies ‘left the back door open’ in terms of internet security. Now they are literally leaving their buildings open to accommodate smokers.
“Once inside a corporate building, an attacker can use social methods on employees to gain access to restricted areas and information unless a rigid staff pass system is in place,” he added.
Smoking will be banned in all indoor public spaces in the UK in July 2007. In many other European countries, such as Spain, workplace smoking restrictions have already been applied.
