Social Engineering: My Career As a Professional Bank Robber

CSO — Jim Stickley got his first computer at age 12, and he was chatting with other computer "nerds" on bulletin board sites by the time he was 16. A wannabe hacker, Stickley said his first foray into playing the system was with free codes -- codes that would exclude his phone and computer time from racking up charges that would incur the wrath of his parents.

Slideshow: 10 Scariest Hacks
Slideshow: By the Numbers: The Impact of Data Breaches

"I started learning the phone systems early. I ended up getting my hands on a lot of old PacBell manuals and I figured out how systems work," said Stickley, now the CTO of TraceSecurity, a security consultancy based in both Louisiana and California.

Learn more about social engineering tricks and tactics

• 4 ways criminal outsiders get inside
• 3 examples of 'human hacking'
• Exploiting 5 security holes at the office (includes video)

As an adult, Stickley channeled his computer and hacking passions into a legitimate career in network security, but soon realized that hardware and software were only part of the security equation.

[Read about the latest scams in 5 more dirty tricks: Social engineers' latest pick-up lines

"When I was spending time testing the network for companies, I would see all these people come and go. You'd see the water delivery guy, or someone else, just come and wander around," he recalled. "It dawned on me I could probably just walk in and steal all the data that they were paying me to secure on the network."

So when Stickley founded Trace Security, he decided to place an emphasis on securing the network and testing the security of the people around it, too. It was a tough sell when the company first launched.

"Ten years ago it was a whole different world. When we first started talking to people about social engineering, it was like selling ice to Eskimos. No one wanted it. No one cared. No one understood the value in it."

But now, organizations, specifically financial institutions, who want to assess risk understand the importance of the human element of security. Stickley and his team regularly conduct "social engineering engagements" where he physically robs banks and "steals" potentially vulnerable items and information. (Read a detailed account of one of Stickley's engagements in How to rob a bank)

Stickley, who says robbing banks is "amazingly easy," explains how he does it, and why he never gets caught.

CSO: How often do you "rob banks" as a social engineering experiment for clients?

Continue Reading