Tutorial on Using Windows 8

Finding things and doing things from the new Windows 8 interface.

The first time I sat in front of the Windows 8 interface, I have to admit I was not thrilled; no Start button, I couldn’t find the control panel, things just weren’t what I was used to. That was over two years ago in the early adopter program for Windows 8, and now when I use Windows XP or Windows 7, I find it very inefficient to "have to click through so many menus" to find and do basic stuff.

The focus of this article is to share with you not simply how to make Windows 8 work like Windows XP/Windows 7 "the old way" (which I will go through and give you tips on how to find stuff and configure stuff to work the old way), but instead to really focus on how to do things better and more easily, effectively helping you shortcut the learning process that makes Windows 8 actually extremely easy and efficient to use.

Note: I've made a copy of this Tutorial available in PDF format so you can easily download and print/keep a copy, the PDF is up in my SkyDrive at https://skydrive.live.com/redir?resid=C99D5C694EA9E532!109&authkey=!ACC7qwl6DQle-SM

First of all, some basic terminology and "old way" of finding things so that I can take you through Windows 8 in a way you have learned how to use Windows. As I’m sure you are aware, Windows 8 no longer has the "Start Button" at the bottom left of the screen. Instead, Microsoft has the "Windows 8 Style Menu" (that they formally called the Metro style menu, until Microsoft was informed Metro Style was copyrighted, so they’re just calling it the Windows 8 Style menu). This is the menu that Windows comes up with.

If you are in the middle of an application (browser, Word, or any other app) and you want to get back to the menu, on a tablet, you press the "Home" button (usually a physical button on the bottom middle of the tablet device) or from a keyboard system, you press the "Windows-key."

The "start button" for the most part (the thing that gives you access to the Control Panel, shutdown/restart, etc) is called the "Charm" and it pops up on a touchscreen tablet when you swipe your thumb from right to left on the right side of the screen (basically swiping the charm menu out from the right edge and into your screen of view). On a keyboard system, the charm menu pops up when you move the move cursor all the way to the right bottom of the screen.

From the charm menu, you can click on the top most icon ("search") and it shows you all of your applications installed (this would be similar to doing a Start/All Programs in Windows 7). You’ll see the search bar (circled in red) and on the left you can scroll through all of your apps.

When you search/find the app you want or simply just scroll through the apps off this Charm/Search view, you can right-click the application, and at the bottom of the screen you are given options to Pin to Start, which adds the app to your Windows 8 Style Menu (THIS is a good idea as it puts a shortcut on your main menu screen so that every time you press the Home button or press the Windows-key, your apps show up on the main menu). You can also Pin to Start things like Control Panel, Command Prompt, Run, etc. I usually Pin everything I usually use/access to the Start which makes it easy for me to just go back to the main Windows 8 style menu to launch my apps!

Note: You’ll also see when you right click an app, you can also Pin to Taskbar (this pins to the old Windows 7 style taskbar at the bottom of the "Desktop" screen). I used to Pin stuff to the Taskbar, but now that more and more apps are coming out with Windows 8 menu icons (like Office 2013, SkyDrive, Box.net, Real Player, etc), I no longer find myself working from the older Win7 "taskbar." This is one of those crutches you can continue to use, or just move into the 21st Century and start using the native Windows 8 menu.

Note: You’ll also see when you right click an app, at the bottom of the screen you can choose to run the app as an Administrator, uninstall the app, find the file/application location. These are helpful "things" we used occasionally in Win7 in the past that you now have shortcuts to run.

Another option off the Charm Menu (when you move your mouse cursor to the bottom right, or swipe your thumb right to left off the right edge of a tablet) is the Settings options (the bottom-most option on the charm) when you click on Settings…

…this is where a LOT of common things are found, such as Control Panel…

…Power (where you choose to shutdown/restart the computer/device), Network (where you select the WiFi connection you want to connect to), Change PC Settings (where you can change other things that are not in the Control Panel like desktop background, the photo you associate to your logon…

…add printers, etc).

Basically click on this Settings place and you’ll get to a lot of things you may normally access for configuration.

Okay, so with the basics under your belt, here’s where you learn to be a Windows 8 person and not a WinXP/Win7 person trying to run Windows 8. Instead of moving your cursor to pop up the charm to then click on Search to then find your application, or instead of moving your cursor to pop up the charm to then click Settings to then go to the Control Panel…you would do one of two things. If you are on a Tablet (or a keyboard-based Win8 device), ADD all of your apps, control panel, etc. to your Windows 8 style menu. It’ll take you a couple minutes to right click and "Pin to Start" all of your apps and utilities, but once they are pinned, you will almost never have to go fiddle with the charm thing. You’ll just press the Home button (on a tablet) or press the Windows key (on a keyboard-based system) and from the menu, click/tap the app and you run the app. To "switch" to another app, press the Home button or press the Windows key and click/tap the other app you want to run. All apps stay in memory; you just "toggle" between apps by simply pressing the Home button or pressing the Windows key to get to your apps.

Note: On a keyboard system, you can still Alt-Tab between apps, so toggling between apps is really easy. No more Start/Programs to get to applications. No need to Charm/Settings/Control Panel to get to the Control Panel if you simply pinned the Control Panel onto your Windows 8 style main menu!

So what happens if you want to access an app that you did not pin to your menu? On a keyboard-based system, at the Windows 8 Menu, just start typing a few letters of the app or function you want to do, and the "search" starts working immediately. For example, at the Windows 8 menu, if I start typing the letters n-o-t-e-p, the search bar will appear in the upper right and it’ll zero in on the Notepad application on the left.

Assuming the app is highlighted on the left, just press the Enter key any time and it'll launch that app, no key clicking, nothing extra. If it pops up several apps with n-o-t-e-p, then either keep typing to zero in on "the app" you want and press Enter to launch, or you can arrow around/tap-touch/click on the app name on the left side to select "the app" you want. Fiddle with this, but effectively this is a very quick way to launch apps that may not be on your Windows 8 menu (yet).

If I start typing w-o-r-d, if I have Microsoft Word on the system, it’ll show me Word, or e-x-c-e-l will give me the option of launching Excel. Or even things like p-r-i-n-t-e-r will pop up under Settings the option for me to "Add a Printer," or n-e-t under search settings will show me options like "Connect to a Network."

Between Pinning things to Start and simply typing a few letters of something, I can launch apps, run utils, add printers, and do things on a Win8 system FASTER than what I thought was super efficient in WinXP or Win7. This was the trick to making Windows 8 easy to use.

Now that you have the navigation thing figured out, go to the Windows Store and download "apps" for your most common things you do, so things like there are Box.com apps, Acrobat reader apps, Picture viewers, Real Media Player app, etc.

Note: When you are in the store looking for apps, as much as you can scroll through the "Popular" apps or "Top free" apps it shows you on screen, if you wanted to "search" for an app to download, it's not intuitive how to search for an app. The way to search for an app is when you are in the Store, pull up the "charm" thing (move mouse to the bottom right, or on a tablet, swipe your right thumb right to left to have the "charm" menu on the right side pop out and then use the "search" function in the charm). So just as you "searched" your apps earlier in this blog to find stuff on your local computer, when you are in the Store app and do a search, it'll now search for apps in the Store (ie: searching for Acrobat, or Box, or Alarm Clock, or USA Today or the like).

When you install the app, it shows up on your Windows 8 Style menu. Simply clicking the app launches the application. However, from your Windows 8 Style menu, you might want to move your most commonly used apps to the left side of your menu so they are visible to you more frequently when you pop up the Windows 8 menu. To move the app with a mouse/keyboard, just click and hold down the mouse button down and “drag" the app to the left. On a touch tablet, you touch the app with your finger and then slide the app "down" and then to the left. This took me a while to figure out as I logically tried to push the app with my finger and immediately drag to the left which would tend to just launch the app. The trick is to touch the app with your finger, drag down a bit, then to the left to move it around! Move any non-commonly used apps from the left side over to the right side so they are out of your way.

Many times apps take up two spaces on the menu. I hate that. I’d rather have all of my apps as the small 1-square wide icon. All you do is right-click the app icon and at the bottom it’ll show you “larger" or "smaller" to make the icon a different size. Some have this option to make small icons larger. Oddly, you cannot tag multiple icons and make them all "Smaller" at the same time, you have to right click and "make smaller" one by one. It takes a few seconds to do, but buys you back more real estate on your Windows 8 menu to get more apps 1 click away to run. (Note: if you have a touch tablet, some of these first time configurations are BEST off doing with a mouse. I would usually plug a USB mouse into my tablet and run through some of these basic right-click configuration things, or drag/drop icon things as it is a LOT faster with a mouse. Everything "can" be done with your finger on a touch screen; it's just not as efficient if you have a lot to configure/setup).

When you are in a Windows 8 app, you likely find there are no application configuration options, settings, things you can do with the app that you have in Windows XP or Windows 7 apps might have found as Tools/Options, or Options/Settings. With Windows 8, apps typically DO have configuration settings, you just have to know how to find them. Here's the trick, app settings are in the Charm/Settings on Windows 8. Launch and sit in the Windows 8 application, and then with a touch tablet, swipe your right thumb from right to left off the left edge of the tablet screen, and press Settings; with a keyboard system, move your mouse cursor to the bottom right to pull up the Charm menu, then click Settings. With the Charm/Settings exposed, you'll see configuration settings for that app!

Also, when you are in a Windows 8 application, there are frequently more options when you "swipe down" from the top of the tablet, or "swipe up" from the bottom of the tablet screen (or on a keyboard-based system, you position your mouse cursor at the top of the screen where a bar appears, or you move the mouse cursor at the top of the screen and right-click). As an example, when I'm in the Internet Explorer in Windows 8 and want to have the Address Bar appear, or I want to switch between IE "tabs", things like the below pop up and give you additional application options...

For applications on your Windows 8 menu, there’s also this thing called "Live Tile," in which the icon changes screens, like the way the CNN news live tile shows you the latest news and flips through things, or the Photos "Live Tile" flips through your pictures. You can turn Live Tile off (again, right click the icon, choose to turn Live Tile on/off). I find it annoying to have the thing flip through stuff when I don’t remember what icon is what, but it's really your call.

To flip through running apps, you can Alt-Tab from a keyboard-based system, or from either a mouse or touch tablet, move the cursor to the upper left hand corner and little tiles of the running apps show in the left margin of the screen. You can right-click and "close" any of those running apps. I used to close apps all the time as I’m old school and after running an app and don’t need it anymore, I close it. But after a while, I just leave the apps running. They don’t take up processing power and with 4-8GB of RAM in my systems these days I have plenty of memory. Every now and then I reboot my device/tablet/system but on occasion, and I will run my finger to the upper left and choose apps to close.

And a hidden thing in the bottom left corner of the screen is a "start"-type button thing that when right clicked will show you a list of common tasks like Event Viewer, Disk Management, Command Prompt, Task Manager, Control Panel, Windows Explorer, Run, etc. It's sometimes helpful to use that, although these days with most stuff on my Windows 8 Menu or I just type a few letters, I don’t bother with these various other menu things, but just FYI…

Logging Out of a system is done by click on your name from the Windows 8 Style menu as shown in the Figure here:

To shutdown or restart the computer, you can navigate the menus (like Charm, Settings, Shutdown), or what I did was create a Windows 8 style menu "app" that I simply click that’ll shut down my computer. You effectively create a "shortcut" on the "desktop" and then you "Pin to Start." That’ll add the shortcut to your Windows 8 menu. Here’s what it looks like:

1) From the Windows 8 menu, click Desktop to switch to the old Windows 7 style desktop
2) Right click on the desktop and choose New | Shortcut
3) When prompted for the Location of the item, enter in c:\windows\system32\shutdown.exe /p as shown below, then click Next
4) For the name of the Shortcut, type in something like Shutdown, then click Finish
5) Right click on the shortcut that is on your desktop and choose Pin to Start

You now have an icon on your Windows 8 menu that allows you to shutdown your system with a single click.

You can change the command syntax in #3 above to restart the computer by making that c:\windows\system32\shutdown.exe /r or /h at the end (instead of /r) will hibernate a system.

Oh, and one more thing - so once I tricked out my Windows 8 menu with all of the icons I wanted, how do I transfer my icons, menu items, etc. to other systems? Microsoft came out with this thing called the User Experience Virtualization (UE-V) that is the new generation of "roaming profiles." However, unlike roaming profiles of the past where EVERYTHING was moved from system to system whether you wanted it or not (ie: registry settings, apps, icons, junk on your desktop, etc), with UE-V profiles, you can specifically just note to "roam" your Windows 8 menu. Microsoft did a case study on my organization’s experience with UE-V [link download].

More information on UE-V is available on the Microsoft site. UE-V isn’t free; it’s part of what Microsoft calls its Desktop Optmization Pack (MDOP) that includes a bunch of other tools like RemoteApp, App-V (application virtualization), VDI, etc. Any case, you might find your organization owns MDOP as part of the Software Assurance for Windows client licensing, and if so, explore UE-V where you can roam your Win8 menu from your desktop, to your laptop, to your tablet, to your VDI guest session, to your Remote Desktop (terminal server) guest session, etc.

Hopefully, this is a place to start. I REALLY fought the whole Windows 8 menu thing for a long time, even filed several "bug reports" during the early adopter program noting that the whole Windows 8 menu was a major "bug," although with a bunch of these tips and tricks I’ve noted in this article, I think you’ll find this whole Windows 8 menu thing to actually be a LOT easier to use and definitely faster than having to fiddle through a bunch of menus.

Questions and Answers
As the "comments" section below has gotten pretty massive, I wanted to create a little index of some of the more helpful questions/answers that people have asked about (and I have answered). Scroll down to the appropriate Comment/Reply below for more info:

Having Windows 8 "forget" the WiFi passcode and WiFi default connection so you can re-enter in a new key or choose a different WiFi default connection (see response to posting from "Sara" from January 5, 2013)
Accessing POP3 email from Windows 8 (see response to post from reedfunchap from January 4, 2013)
Re-associating Windows 8 with a new email / logon / local account without having to restore the whole new system (see response to post from catey44 from January 1, 2013)
Difference between a Windows 8 Store "App" and downloading an app from a vendor's site (see response to post from Scott Schulte from January 1, 2013)
Disabling the "Charm" from popping out all the time see response to post from Jesse A Vasquez from December 23, 2012)
Adjusting the timezone in Windows 8 (see response to post from Sabir Ali from December 17th-ish, 2012)
Choosing a different "response" when a device is plugged into a system, ie: setting a new default action for a device (see response to post from Ken Reynolds from early December 2012)
As I respond to "comments" with information of value, I'll continue to add the info in here for a quick summary...



Several other postings I’ve done on Windows Server 2012, Exchange 2013, Intune, System Center, etc. Just click the Next Article or Previous Article buttons on this blog post to get to other articles I’ve covered, or click here to see a listing of all of the various blog posts I’ve done over the years. Hopefully this information is helpful!

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Nearly a week in, Yahoo still fixing email woes

Yahoo says its engineers are 'making steady progress,' but the system still isn't fully restored

Nearly a week after Yahoo's email service crashed, the company is still working to bring it all back.

At 10:45 p.m. ET on Sunday, a report posted on Yahoo's Mail Status page reported that company engineers had been working on the email problems over the weekend and were "making steady progress" on restoring lost messages. The Yahoo team is restoring folders and the tools that can tell users whether a message has been read.

"As part of the restoration process, some timestamps may not appear correctly on some of your messages," the company said in the post. "Thank you again for your continued patience through this process and we will share an update again tomorrow."

The Mail Status page has not yet been updated.

Patrick Moorhead, an analyst at Moor Insights & Strategy, described the email system crash and continued problems a huge blow to Yahoo, which has been trying to overhaul its image as an Internet has-been.

"I don't recall any other service like this being down this long over the past 15 years," he added. "It makes Yahoo look like a real Web rookie. If Yahoo doesn't fix [it soon], day-by-day they will continue to lose more credibility as a Web services company."

The gains made by CEO Marissa Mayer over the past year are now in jeopardy, Moorhead noted.

"Mayer has built some goodwill for Yahoo since her tenure, slowly shifting the perception from a has-been to a company that has a chance," said Moorhead. "This incident will surely hurt any perception of improvement. People must be thinking, 'Email is so '90s. How can they do mobile or search well?' "

Mayer on Friday said said she is "very sorry" for the week-long outage.

"For many of us, Yahoo Mail is a lifeline to our friends, family members and customers," Mayer wrote in a Tumblr post. "This week, we experienced a major outage that not only interrupted that connection, but caused many of you a massive inconvenience. That's unacceptable and it's something we're taking very seriously. Unfortunately, the outage was much more complex than it seemed at first."

She added that users are affected differently, making the restoration process all the more complex.

"Above all else, we're going to be working hard on improvements to prevent issues like this in the future," Mayer wrote. "While our overall uptime is well above 99.9%, even accounting for this incident, we really let you down this week. We can, and we will, do better in the future."

Yahoo's mail service began floundering around 1:30 a.m. ET on Tuesday, Dec. 10, when users began reporting that they couldn't access email in their inboxes, and that emails they had sent weren't being delivered.

Yahoo had told users a few times last week that the service would be back up and running correctly within a few hours.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

The worst IT project disasters of 2013

The Healthcare.gov rollout leads a pack of painful projects

Trends come and go in the technology industry but some things, such as IT system failures, bloom eternal.

"Nothing has changed," said analyst Michael Krigsman of consulting firm Asuret, an expert on why IT projects go off the rails. "Not a damn thing."

"These are hard problems," he added. "People mistakenly believe that IT failures are due to a technical problem or a software problem, and in fact it has its roots into the culture, how people work together, how they share knowledge, the politics of an organization. The worse the politics, the more likely the failure."

Here's a look at some of this year's highest-profile IT disasters.

Healthcare.gov: By now everyone knows about the health insurance shopping website's problems upon the Oct. 1 go-live, when many users couldn't access the system and only about 30 percent were actually able to sign up for health care.

Following a frenzied effort to fix bugs in the system, U.S. officials said Healthcare.gov had been stabilized as of Dec. 1. But the work is not yet complete. Last week, officials said 25 percent of applications sent from Healthcare.gov to private insurers contain errors that were caused by the website.

Yet to come is a final fix, as well as a full accounting of why the Healthcare.gov launch stumbled.

Krigsman is skeptical that fallout from Healthcare.gov will lead to any major reforms. But the controversy has had one effect, he added. "IT failures have really hit the mainstream media in a way they never did before."

Queensland Health payroll system: The government of Queensland, Australia, announced in August that IBM would no longer be allowed to sign new consulting contracts with the state after its "bungle" of a payroll system project that reportedly could cost taxpayers up to AUS$1.2 billion (US$1.1 billion).

"It appears that IBM took the state of Queensland for a ride," Queensland Premier Campbell Newman said at the time.

Last week, Newman's administration began pursuing a lawsuit against IBM, according to published reports.

It's not clear how that effort will play out, given that a 264-page analysis of the project commissioned by the government concluded earlier this year that due to past agreements, "there was no means by which the State may seek damages from IBM for breach of contract."

For its part, IBM has maintained that the project's issues were out of its hands, and that the state failed to properly scope the project and define its requirements.

MyCalPAYS: In February, the state of California terminated its contract with SAP in connection with a massive payroll project called MyCalPAYS. More than US$250 million has been spent on the project, which dates to 2005. SAP, which says it isn't to blame for the problems, came aboard after the state fired original contractor BearingPoint.

Last month, California Comptroller John Chiang filed suit against SAP, seeking compensation. California has paid SAP $50 million for its work on the project, but it's not clear how much money the state will get back even if its lawsuit is successful.

Marin County, California, sued SAP and Deloitte over a different ERP project. The case was settled but reportedly netted the county only $3.9 million, after it spent $5 million on legal fees and more than $30 million on the system, which will be replaced with a different product.

Royal Bank of Scotland: Computer system woes continued this year for RBS, including an outage on Cyber Monday that left account holders unable to make payments or get cash.

The Cyber Monday failure was "unacceptable," RBS CEO Ross McEwan said in a statement. RBS has failed to properly invest in its IT systems for decades, but a plan is under way now to change that with details coming next year, he added.

Last year, RBS suffered an IT failure that led to delays in wage and tax credits being paid into customer accounts.

Deloitte's unemployment system woes: Deloitte found itself under fire in California, Florida and Massachusetts this year over problems with unemployment compensation systems built by the consulting firm.

The problems resulted in delayed payments to thousands of job seekers. Deloitte principal Mark Price told Massachusetts lawmakers during a public hearing in October that the state had "a successful, working system today," and only a "relatively small percentage" of jobless people had been affected. The problems stemmed from "very specific data issues" in the state's legacy system, he said. Price also said the reports of problems with Deloitte's projects in Florida and California were overblown.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Social Engineering: The Basics 2014

What is social engineering? What are the most common and current tactics? A guide on how to stop social engineering.

You've got all the bells and whistles when it comes to network firewalls and your building's security has a state-of-the-art access system. You've invested in the technology. But a social engineering attack could bypass all those defenses.

CSO's ultimate guide to social engineering

Say two fire inspectors show up at your office, show their badges and ask for a walkthrough—you're legally required to give them access to do their job. They ask a lot of questions, they take electrical readings at various wall outlets, they examine wiring under desks. Thorough, aren't they? Problem is, in this case they're really security consultants doing a social engineering 'penetration test' and grabbing access cards, installing keystroke loggers, and generally getting away with as much of your business's private information as they can get their hands on. (See How to rob a bank for details from this real-world example.)

Social engineers, or criminals who take advantage of human behavior to pull of a scam, aren't worried about a badge system. They will just walk right in and confidently ask someone to help them get inside. And that firewall? It won't mean much if your users are tricked into clicking on a malicious link they think came from a Facebook friend.

In this article, we outline the common tactics social engineers often use, and give you tips on how to ensure your staff is on guard.

Social engineering is essentially the art of gaining access to buildings, systems or data by exploiting human psychology, rather than by breaking in or using technical hacking techniques. For example, instead of trying to find a software vulnerability, a social engineer might call an employee and pose as an IT support person, trying to trick the employee into divulging his password.

Famous hacker Kevin Mitnick helped popularize the term 'social engineering' in the '90s, although the idea and many of the techniques have been around as long as there have been scam artists of any sort. (Watch the video to see social-engineering expert Chris Nickerson size up one building's perimeter security)
Through a Social Engineer's Eyes
Social Engineering expert Chris Nickerson reveals what criminals are looking for when it comes vulnerabilities in building security.

How is my company at risk?

Social engineering has proven to be a very successful way for a criminal to "get inside" your organization. In the example given above, once a social engineer has a trusted employee's password, he can simply log in and snoop around for sensitive data. Another try might be to scam someone out of an access card or code in order to physically get inside a facility, whether to access data, steal assets, or even to harm people.

Chris Nickerson, founder of Lares, a Colorado-based security consultancy, conducts 'red team testing' for clients using social engineering techniques to see where a company is vulnerable. Nickerson detailed for CSO how easy it is to get inside a building without question.

In one penetration test, Nickerson used current events, public information available on social network sites, and a $4 Cisco shirt he purchased at a thrift store to prepare for his illegal entry. The shirt helped him convince building reception and other employees that he was a Cisco employee on a technical support visit. Once inside, he was able to give his other team members illegal entry as well. He also managed to drop several malware-laden USBs and hack into the company's network, all within sight of other employees. Read Anatomy of a Hack to follow Nickerson through this exercise.

In What it's like to steal someone's identity professional pen tester Chris Roberts, founder of One World Labs, says he too often meets people who assume they have nothing worth stealing.

"So many people look at themselves or the companies they work for and think, 'Why would somebody want something from me? I don't have any money or anything anyone would want,'?" he said. "While you may not, if I can assume your identity, you can pay my bills. Or I can commit crimes in your name. I always try to get people to understand that no matter who the heck you are, or who you represent, you have a value to a criminal."

Sneaky stuff. Give me some specific examples of what social engineers say or do.

Criminals will often take weeks and months getting to know a place before even coming in the door or making a phone call. Their preparation might include finding a company phone list or org chart and researching employees on social networking sites like LinkedIn or Facebook.

In the case of Roberts, he was asked to conduct a pen test for a client who was a high-net-worth individual to see how easy it would be to steal from him. He used a basic internet search to find an email address for the individual. From there, it snowballed.
Useful Books on Social Engineering!

No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing
By Johnny Long et al (Syngress 2008)
"Whether breaking into buildings or slipping past industrial-grade firewalls, my goal has always been the same: extract the informational secrets using any means necessary."

"We searched for the e-mail address online were able to find a telephone number because he had posted in a public forum using both," said Roberts. "On this forum, he was looking for concert tickets and had posted his telephone number on there to be contacted about buying tickets from a potential seller."

The phone number turned out to be an office number and Roberts called pretending to be a publicist. From there he was able to obtain a personal cell phone number, a home address, and, eventually, mortage information. The point being from one small bit of information, a social engineering can compile an enitre profile on a target and seem convincing. By the time Roberts was done with his pen test, he knew where the person's kids went to school and even was able to pull a Bluetooth signal from his residence.

Once a social engineer is ready to strike, knowing the right thing to say, knowing whom to ask for, and having confidence are often all it takes for an unauthorized person to gain access to a facility or sensitive data, according to Nickerson.

The goal is always to gain the trust of one or more of your employees. In Mind Games: How Social Engineers Win Your Confidence Brian Bushwood, host of the Internet video series Scam School, describes some of the tricks scam artists use to gain that trust, which can vary depending on the communication medium:

-- On the phone:
A social engineer might call and pretend to be a fellow employee or a trusted outside authority (such as law enforcement or an auditor).

According to Sal Lifrieri, a 20-year veteran of the New York City Police Department who now educates companies on social engineering tactics through an organization called Protective Operations, the criminal tries to make the person feel comfortable with familiarity. They might learn the corporate lingo so the person on the other end thinks they are an insider. Another successful technique involves recording the "hold" music a company uses when callers are left waiting on the phone. See more such tricks in Social Engineering: Eight Common Tactics.

-- In the office:
"Can you hold the door for me? I don't have my key/access card on me." How often have you heard that in your building? While the person asking may not seem suspicious, this is a very common tactic used by social engineers.

In the same exercise where Nickerson used his thrift-shop shirt to get into a building, he had a team member wait outside near the smoking area where employees often went for breaks. Assuming this person was simply a fellow-office-smoking mate, real employees let him in the back door with out question. "A cigarette is a social engineer's best friend," said Nickerson. He also points out other places where social engineers can get in easily in 5 Security Holes at the Office.

This kind of thing goes on all the time, according to Nickerson. The tactic is als o known as tailgating. Many people just don't ask others to prove they have permission to be there. But even in places where badges or other proof is required to roam the halls, fakery is easy, he said.

"I usually use some high-end photography to print up badges to really look like I am supposed to be in that environment. But they often don't even get checked. I've even worn a badge that said right on it 'Kick me out' and I still was not questioned."

-- Online:
Social networking sites have opened a whole new door for social engineering scams, according to Graham Cluley, senior technology consultant with U.K.-based security firm Sophos. One of the latest involves the criminal posing as a Facebook "friend." But one can never be certain the person they are talking to on Facebook is actually the real person, he noted. Criminals are stealing passwords, hacking accounts and posing as friends for financial gain.

One popular tactic used recently involved scammers hacking into Facebook accounts and sending a message on Facebook claiming to be stuck in a foreign city and they say they need money.

"The claim is often that they were robbed while traveling and the person asks the Facebook friend to wire money so everything can be fixed," said Cluley.

"If a person has chosen a bad password, or had it stolen through malware, it is easy for a con to wear that cloak of trustability," he said. "Once you have access to a person's account, you can see who their spouse is, where they went on holiday the last time. It is easy to pretend to be someone you are not."

See 9 Dirty Tricks: Social Engineers Favorite Pick-up Lines for more examples.

Social engineers also take advantage of current events and holidays to lure victims. In Cyber Monday: 3 online shopping scams and 7 Scroogeworthy scams for the holidays security experts warn that social engineers often take advantage of holiday shopping trends by posioning search results and planting bad links in sites. They might also go as far as to set up a fake charity in the hope of gaining some cash from a Christmas donation.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com