When a consulting company or headhunter contacts you through LinkedIn or another professional networking site, be wary of the offer. Do your due diligence to verify the offerer and the offer. If it seems too good to be true, it probably is, and could be nefarious and dangerous.
A 10/12/20 article by Bruce Sussman on SecureWorld opens the window on the the situation:
How China Secretly Recruits U.S. Citizens with Security Clearances
Sussman based the article on U.S. Department of Justice court filings, and links to an important FBI page,
The China Threat: Foreign Intelligence Services Use Social Media Sites to Target People with Securit...
The article and the video linked from both sites tell the steps of recruitment and then compromise that the Chinese intelligence service has used. While they focus on U.S. residents with security clearances, do not think that the warnings apply only to cleared personnel, or that the Chinese are the only actors in this arena. Corporate espionage looking for proprietary information and trade secrets is just as much a danger as nation-state espionage in the national security arena.
Information security or cybersecurity workers often have deep knowledge about compromises, protections, and counter-measures that would be of value to threat actors. Even if they already know about the measures and countermeasures, they may well want to know what you know, that is, what your employer knows.
Protect yourself, and protect your enterprise. If the money seems too good for the work expected, and if the recruiter spends more effort selling the company to you than digging into your qualifications to be hired, then you have been handed two Big Red Flags that you could be in serious professional and legal jeopardy if you sign on for that side gig.
(c) 2020 D. Cragin Shelton
(Originally published on my Randomness blog.)
