Read 3 Files And Answer Them . Answers must be In 3 Different Files

This looks like a classic case of social engineering, in particular, vishing (extracting information over the phone) and phishing (fraudulent email), in which a human being is trying to extract potentially sensitive information about a company’s computer infrastructure.  In social engineering, people rely on the fact that human beings are basically helpful and don’t mind speaking about things they know. In fact, we are often boastful about the things we know.

Instead of indulging in a knee-jerk reaction and taking decisions in haste, I would first start off by understanding the source of the phone calls and emails. 

The first thing that comes to my mind is the various security and confidentiality workshops that were conducted at Cisco Systems, my previous workplace. We used to get security questionnaire based on an online security course we had to take every quarter. And this is exactly what we were made aware of. We were explicitly taught in the course how people could call us asking us about the workplace to start with and how at times it could lead to us divulging sensitive information about computer infrastructure etc. 

My recommendations would revolve around company-wide policy regarding security and confidentiality of information.

Education:

1.  There must be training materials in place to make company employees aware of what needs to be done when these kinds of phone calls or emails are received.

2. All the people who do have access to sensitive information to be made aware of how to handle these kinds of phone calls and emails.

Security policies:

1. The company security measures should ensure that not all employees are allowed access to all the resources in the company. Only authorized people would have access to the vital company computer infrastructure. So even if someone gets this kind of a phone call, he/she wouldn’t be able to reveal any information that he has no access to.

Physical Security:

1. The incident of people having free access to company dumpster is alarming. No outsider must be able to have physical access to company dumpster without proper authorization or permission. I would first recommend a robust physical security measure (Use of video cameras, security guards, etc.)

References:

 Rouse, M. (2018, May). What is social engineering? - Definition from WhatIs.com. Retrieved from https://searchsecurity.techtarget.com/definition/social-engineeri