All 100 indicators / Category 1.x: Authority-based
Indicator 1.1
Measures automatic compliance with perceived authority figures without verification, creating systematic vulnerabilities when requests appear to come from executives, IT staff, or other trusted sources
Employees automatically follow requests from perceived authority figures without verification, bypassing normal security protocols when commands appear to come from executives, IT staff, or other trusted sources. This psychological vulnerability enables attackers to impersonate authority figures and manipulate staff into compromising security controls, transferring funds, or sharing sensitive information. Organizations with rigid hierarchies or high-stress environments amplify this risk significantly.
Unquestioning compliance operates through deeply ingrained evolutionary and social conditioning. Milgram's obedience studies (1974) demonstrated 65% compliance with perceived authority even when causing apparent harm.This automatic deference served evolutionary survival purposes within hierarchical groups but creates exploitable vulnerabilities in cybersecurity contexts where authority claims may be fabricated.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Multi-channel verification required for all unusual requests; employees regularly verify authority claims without organizational punishment; documented escalation procedures exist and are consistently followed. Strong cultural support for respectful verification behaviors.
Some verification protocols exist but are bypassed during 'emergencies'; occasional verification occurs but inconsistently; mixed organizational messages about challenging authority. Verification procedures documented but not culturally reinforced.
No systematic verification requirements; employees report fear of questioning authority figures; frequent emergency bypasses of security protocols; organizational culture punishes questioning of authority requests. Compliance valued over security verification.
Implement mandatory secondary verification for all unusual requests via different communication channel
Deploy automated verification reminders in email systems flagging requests for money, credentials, or system changes. Train employees: if email request → verify by phone using known numbers; if phone request → verify by email. Create verification scripts that feel respectful rather than insubordinate.
Create 'respectful verification' training teaching employees to verify authority claims professionally without damaging organizational relationships
Include role-playing scenarios with C-level executives demonstrating proper verification behaviors to normalize the practice organizationally. Teach specific verification scripts and language that maintains hierarchical respect while ensuring security. Celebrate verification behaviors publicly.
Deploy internal communication platform with verified identity badges/certificates for authority figures
Implement email authentication systems (DMARC, SPF, DKIM) with visual indicators showing external vs. internal communications and verified vs. unverified sender status. Create verified authority contact database that employees can reference.
Create formal escalation procedures requiring supervisor approval for any security protocol bypass
Establish 'cooling off' periods for emergency requests, requiring 4-hour delays for high-risk changes unless verified through multiple channels. Implement automated logging of all exception requests with regular quarterly review.
Conduct quarterly social engineering tests using fabricated authority requests (with legal/HR approval)
Measure compliance rates and provide immediate coaching for failed verifications. Track improvement trends across organizational levels. Use results to identify high-risk departments and individuals for additional training.
Maintain centralized database of authorized vendor contacts with verified communication channels
Require all external authority claims to be cross-referenced against verified contact database before granting access or providing information. Regular quarterly updates to vendor contact information. Multi-party approval for any vendor access requests.
Develop explicit organizational policies protecting employees who verify authority claims
Create positive recognition programs for appropriate security verification behaviors. Train leaders to model and encourage verification rather than viewing it as questioning authority. Publicize examples of employees who prevented security incidents through proper verification.