Education and well defined processes. If a company has very well defined processes for what kinds of things can be communicated over the phone, email, and chat then the company is a lot safer. The book goes into great detail in explaining that if many of those people simply knew what they could and could not say over the phone the scam would never have happened.

Assessment as well as security education. Companies should conduct tests on their staff to check the level of security awareness, before an attacker does so. The objectives of these tests should be to raise awareness and not make an example of some poor person who has just been scammed.
When it comes to education too often companies carry out once-off workshop, the essence of which get lost to the ordinary employee a few months later. This as well needs to be an ongoing practice. Agreed, well defined processes are an absolute must.

> Let me know if you can think of any way that social engineering can be used for
> non-nefarious purposes. Right now I can't seem to think of any...

I would say it depends both on your definition of "social engineering" and "nefarious purpose".

For example, pretending to be someone who you are not is a common social engineering technique. It's also valuable for salesmen and job-hunters trying to gather information about who are the decision makers.

Shmoozing the secretary or receptionist is also a time tested technique for salesmen and for job-hunters, and is used by the fraudster.

Just as reverse-engineering publicly visible code and communications protocols is useful for both fraudsters and those trying to extend the life of old, crufty applications.

Certainly using these techiques to glean passwords, etc is nefarious; what about using these techniques to try to determine if a prospect is really planning to purchase a product, or just window-shopping? Of if the job is really going to go to the person with "proven C++ skills" or the friend of the CEO's nephew with no skills and a large supply of BS?

Ah, the difference between a white lie and true deception. I would follow along with the common consensus (maybe not common, but general feeling) that as long as the lie doesn't hurt anyone, then it's still not true deception. I don't subscribe to that definition personally, and I'm sure that others would agree that honesty is the best policy, but then again, I'm not in any profession that may require deception as a means to an end.

"Education of your employees is paramount to stop se attacks" That is defintive true, but defence must start from company security policy

If you were honest with yourself and your students, you would have brought up the "pretexts" that investigators used to out an HP board member... and which point you should have reminded the students that state/authority commited fraud is, well, in it's own machavellian way OK... life is full of little contradictions and hypocracies like that.

Actually, I did point this out and I also referenced this post...
http://weblog.infoworld.com/zeroday/archives/2006/09/hp_made_me_do_i.html