Currently, I’m creating a few organizational charts to use myself, but for the purpose of making sense of companies during the economy we’re in if for no other reason, but to find the people now responsible for functions so I know who I need to be working with - not even competitor stuff here. It’s been very challenging with all the lay-offs happening on large scales to even know who is still a contact yet alone what business units might still exist in a company. Nonetheless, no matter the challenge ahead, I’ll stick to the principals I’ve mentioned in previous blogs - ethical means. To me, the phone is the most powerful tool out there to get information even in the internet era we live in. There are some grey areas though, but I hope I can provide a few examples of ethical ways versus unethical ways of conducting phone calls to obtain information.
In this discussion, I’ll give a few examples on how to obtain information needed for an org chart build. Each example will give you an idea of how a Social Engineer (SE) might go about phone calls versus a Competitive Intelligence (CI) professional.
Essentially, I want to find titles of people so I can understand their responsibility and where they fit in the org chart. My end goal is to find their contact information and get them on the phone and preferred over e-mail though e-mails are okay. However, understanding where people fit into an organization and what they do is a powerful asset to have in advanced of conversations and reason I build org charts. Half the battle is getting someone on the phone in the first place or if you get their voice mail, how does one get them to call you back? So, the more information you have in advanced, the better equipped you are to get them to return your calls or engage with them on the phone if you get lucky to reach them live in the first place.
Time is precious so you want to maximize your time and theirs. First goal, who are the people (names) you need to find information about – name and title, then start arranging them in the reporting structure – piece the puzzle together. A later entry will address voice mail and how I’ve been successful in getting people to call me back when someone receives so many calls a day. Getting someone on the phone is far better than e-mail for the obvious reason – e-mails are in writing and what you put in writing can 1 - be forwarded to others and 2 – highly trackable and a concrete footprint. The IT geeks out there (heh – I love you guys, but very aware of what you can do too!) can easily look up an IP address and track the source of the e-mail down if made up or locate someone via IP address who reads a blog or website…Phone is definitely my favorite source of information more so today than ever in our information highway. There is NO substitution to the human element period and the best source of current information. Yeah, I'm old school in many ways, but extremely effective at what I do friends and can do on the phone!
Phone Calls
Example 1: Martha wants to find out all the direct reports of the VP of Product Marketing for company ABC. Take 1 minute and go on company ABC’s website and view the various product lines – no matter if a car manufacturer, retailer, software company, etc., the website will tell you what product lines they have and great starting point. I’ll keep this entry very big picture here and basic as I could write an entire chapter in a book on a detailed case study.
Scenario: You know the 5 product divisions and that each division has let’s say, 5 products in each division as listed on the website. Each product will have 1 product manager at least. Per a previous entry, think about the white boarding I mentioned and the larger the company the more people they will have to do the particular functional area, but will split the roles into a few. This entry doesn’t even matter with this amount of detail really, but want you to think about what you are trying to achieve as you place calls - validate names, titles and who they report to.
Martha calls into company ABC and Stewart answers the phone.
Approach when Stewart answers the phone at Company ABC:
Hi Stewart, I’d like to speak to the Director of Product marketing for yellow apples. Stewart: “Who is this and where are you calling from?”
CI: I’m sorry about that Stewart; this is Martha calling from New York City.
SE: I’m sorry about that Stewart; this is Martha calling from “Company ABC’s” New York City office.
Observation here – the difference, CI tells Stewart where they actually are physically located – he didn’t ask, what COMPANY you were calling from, but WHERE. The SE lies and alludes to working for the same company as Stewart.
Stewart: Okay Martha, I’m not at liberty to give out names or numbers.
CI: I understand Stewart. The person I think I’m trying to reach is Bob Barker (researched quickly on Google and LinkedIn to find a valid name associated with the specific product line). Last to my knowledge, Bob was the person in charge of yellow apples, but it’s been awhile since I was in contact. With all the changes in your company, I’m not sure if he’s still the right person.
SE: Stewart, I’m the system administrator in our New York City office and our servers are down. I can’t access our company directory right now, but have a request in my inbox from a generic yellow apple marketing e-mail. I need to get in touch with the Product Marketing Director to configure the request when our servers come back on line. I can’t tell who this is since a generic yellowapple@companyXYZ.com e-mail. The request seemed urgent.
Example 2: You now know Bob Barker is in charge of yellow apples at this point and want to validate his reporting structure upstream to the VP and try to find out others in Bob’s peer group.
CI: Stewart, I know Bob is in charge of yellow apples and reports to the VP of apple trees. Is this correct? I haven’t connected with Bob in awhile, but need to get in touch with his peer for green apples as well. Is this Bill now? I’m assuming that Bob and Bill report to the same VP and I have this right based upon my contact list and experience with these guys, but I need to understand also who is the right person to contact for Oranges, Bananas and Grapefruits as all of these folks need to be included in correspondences from me according to past conversations with Bob, but not sure who they all are. Bob’s v/m indicated he is on vacation for 2 weeks and I don’t have 2 weeks to wait to speak to these people.
SE: Stewart, I’ve talked to Bob at yellow apples and he told me who was in charge of green apples at our New York site, but don’t have this information handy. I’m traveling and had a v/m from him last week, but need to get a hold of him ASAP since he left me a v/m. Unfortunately, I deleted the message and can’t access the company directory right now from where I am. I need to also get in contact with the people in charge of oranges, bananas and grapefruits since Bob mentioned they are his peers and also need to be included in the e-mail box he asked me to set up for this team. I’d suggest you send me an e-mail with all their names and contact information since I’m an internal employee, but our servers are down and I won’t be able to access this until our servers come back up. You can in tandem send me an internal e-mail, but copy me to my personal e-mail or just tell me on the phone for now. I need to get in touch with these people today and speak to them live so I can ensure I get the right people set up on this confidential e-mail directory I need to set up. I have a deadline to meet and need to call them today.
Obtaining an E-mail address:
First step, Google is great if you know how to write scripts and search strings….yet, another later blog entry on tips and tricks using Google and other search engines as there are a few typographical differentials for each search engine. In headhunting, there are ethical hacks with search strings to find information without hacking into databases. We don’t need to hack into firewalls nowadays people nor do CI people practice this in the first place as information is out there and quite visible IF you know how to use the tools.
CI: Stewart, I sent Bob an e-mail to Bob.Barker @xyz.com, but it bounced back. Has Bob left the company? I’m trying to follow up with him about a yellow apple marketing campaign we planned for next month. Is he still with the firm or did someone else take on his role? Is this the correct e-mail or maybe I typed it in wrong? His boss sent me an e-mail from VP.yellowapple@ xyz.com and thinking I have it correct, but wanted to make sure due to the proprietary content I need to send. Better to be safe than sorry, right?
SE: A SE can do 1 of 2 things here. They might set up a fabricated e-mail as to appear to be an internal e-mail that they configure to forward to another e-mail address because SE’s tend to be technical by background, but use the human element to trick people. In this scenario, validating the correct e-mail is first step though my point, a SE has the ability to fabricate an e-mail or set up a fake website to get people’s information. Second, a SE might also pose once again as an internal employee on the phone…Stewart, our server is down and I need to get e-mails for a few people and need to send them e-mails, but need to do it from offsite since our server is down today. What are the e-mails for the product marketing people? You can validate I’m for real if you’d like by sending me an e-mail internally, but need to copy my personal e-mail too since I can’t access our internal e-mail today with servers down. At least you’d know it won’t be rejected and I’m who I say I am. 99 out of 100 times, no one would question this line and directness as it seems real and quite bold.
Too much effort on my end to fabricate and nor do I practice this type of work. Much easier and ethical to tell the truth and ask for what I need without concocting some story really. This is very big picture though and touches the surface on situational awareness and simply used the phone as an example in this entry.
The end goal of a Competitive Intelligence Professional is to obtain information legally and ethically to interpret and package information towards actionable use towards Business objectives and translate into business use. HOW one obtains this information is my point here and in this series of past 3 blog entries I focused on information to seek,find and how to build an organizational chart with emphasis on using the phone as your main tool. This last entry is quite high level and broad assuming one has minimal information to start with though a CI expert can and will do primary research in advanced and can do so quicker than a hacker can hack into a company's database or a social engineer can concoct some fabricated scheme to obtain the same information. It's all about knowledge, methodologies and techniques BUT LEGAL.
No comments:
Post a Comment