Russians are hacking HRC staffer emails

[Foggyhill]

2. They're using phishing and social engineering, not really "hacks"; people will click on anything

Most so called "hacks" including those at DNC have started that way.
In fact, almost all information that's gotten out of organisations has been had in that low key way.

I don't get how gullible people are (it frustrates all attempts at security); and yes, I'm an expert on computer security.
I'm the kind of person who actually knows what a real hack is; 99.99% of these are not.

They don't need to be cause it is so easy to trick people in giving their keys away.

It is of course bothersome, cause those phishing attacks are targetted, probably uses
public knowledge of people working there to create good phishing attacks.
Once they've got one account, phishing other accounts becomes much easier.
Eventually, if they stay long enough a place with the level of security 99% of orgs have, they hit
someone with admin access. That's when you get real damage done as they can they can just about anything.

People have to wise up to those techniques, even those who think they're not that important.
They are, they can be used to get through a chain of people to someone eventually very important.

People are such a risk that a secure system must assume people inside will eventually be compromised and
mitigate against such things.