Exercise 2: Why the Coffee-Break Visitor Needed None of Chapters 2-3's Techniques — Possible Solution ==================================================================== WHAT CHAPTERS 2-3's TECHNIQUES ARE ACTUALLY FOR ------------------------------ Phishing (Chapter 2) and pretexting/impersonation (Chapter 3) all exist to solve one specific problem for an attacker: gaining access or information from someone who currently controls it, by manipulating that person into handing it over voluntarily. They're persuasion techniques - their entire purpose is convincing a person to grant something they otherwise wouldn't. WHAT THE UNLOCKED WORKSTATION REMOVES FROM THE EQUATION ------------------------------ Per this chapter, "an unlocked, already-authenticated support workstation removes the need for any of that effort at all." If the ticketing system, remote-access tool, and everything else are already open and logged in, there's no access left to persuade anyone into granting - the access already exists, sitting unguarded. There's no person to convince, no backstory to construct, no identity to impersonate, because the step all of that effort was meant to achieve has already happened by accident. WHY THIS MAKES THE UNLOCKED SCREEN WORSE THAN A FAILED SOCIAL- ENGINEERING ATTEMPT ------------------------------ Every technique in Chapters 2-3 can fail - a target can recognize the phishing email, verify the caller's identity (Chapter 4), or simply say no. An unlocked screen offers no equivalent chance to catch or resist anything, because there's no request being made and nothing to evaluate - the opportunity is simply available to whoever happens to be nearby. WHY THE CHAPTER FRAMES THIS AS "DOING ALL THE WORK" FOR THE VISITOR ------------------------------ Per this chapter, "the unlocked screen did all the work for them" - meaning the single lapse (not locking the screen) accomplished everything the earlier chapters' elaborate techniques were built to achieve, with none of the effort, risk of detection, or chance of failure those techniques normally carry. WHY THIS WORKS AS AN ANSWER ------------------------------ It explains what social-engineering techniques are actually trying to achieve (access via persuasion), explains why an already-unlocked, authenticated session removes that problem entirely, and explains why that makes the unlocked screen a more complete failure than a foiled attempt would have been.