The support phone call that brought down MGM in Vegas

I wonder if the audio from that phone call will ever be released. That would be a great teachable moment on what to do and what not to do when performing employee verification over the phone.

Employee verification should not be employed over the phone.  Granting access to institutional/security info via phone is an extremely bad institution practice.

The explanation sounds rather shoddy for the security breech, IMO.

Louis

Totally agree. Like it's been said online plenty of times in recent weeks, a three-billion dollar company was taken down by a ten-minute phone call.

Here's a question: what's a secure way to verify an employee's identity under these circumstances? Seems like the last four of the SSN isn't really a solution anymore.

The crooks are coming up with new approaches to gaining access to otherwise secure networks.  The weakest link in the security chain is the user.  Convincing them to click on a link or divulge some personal bit of info.  A little bit here and bit there and you could create a convincing story to feed an unsuspecting user to allow entry through their or another users passwords.  Over the phone is just as un-secure as an e-mail or text.  You have no idea who the other person really is and should not disclose any personal info via that media.