All 100 indicators / Category 1.x: Authority-based
Indicator 1.10
Measures vulnerability to automatically granting elevated privileges or bypassing security protocols during crises based solely on authority claims, without proper verification
Crisis Authority Escalation occurs when employees automatically grant elevated privileges or bypass security protocols during high-stress situations based solely on authority claims, without proper verification. During crises, people seek quick decisions from authority figures and skip normal security checks due to time pressure and stress. This creates a prime opportunity for attackers to impersonate executives or IT leaders during emergencies to gain unauthorized access to systems and sensitive data.
During crisis conditions, cognitive resources become severely limited, forcing individuals to rely on System 1 (fast, automatic) rather than System 2 (slow, deliberate) thinking. Crisis states activate the amygdala's threat response system, flooding the brain with stress hormones that impair prefrontal cortex functioning. This neurochemical cascade creates hypervigilance to authority cues while simultaneously losing capacity for critical analysis. Milgram's obedience studies (1974) showed that compliance with authority increases dramatically under crisis conditions as individuals seek external structure to manage overwhelming uncertainty.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Documented emergency procedures require multi-person verification for all elevated access. Regular crisis simulation training includes authority verification components. Secure communication channels with authentication for crisis communications. Break glass access used less than quarterly with full documentation.
Emergency procedures exist but allow single-person authorization in some situations. Crisis training occurs annually but limited focus on authority verification. Some secure communication channels but gaps in crisis communication security. Break glass access used monthly with basic approval processes.
Emergency procedures routinely bypass normal security controls without verification. No regular crisis training or authority verification training. Crisis communications primarily through unsecured channels. Break glass access used weekly or more with minimal oversight. Culture of not questioning authority during emergencies.
Implement two-person integrity requirements for all emergency access grants during crises
Any crisis-related security bypass requires approval from two separate authorized individuals with independent verification of requestor identity. Create pre-authorized crisis response teams with verified contact methods. Implement automated system requiring dual approval before emergency access grants take effect.
Deploy secure communication platforms with multi-factor authentication for crisis communications
Establish dedicated crisis communication channels with strong authentication. Implement pre-shared verification codes or phrases that legitimate authority figures use to confirm identity during emergencies. Create photo identification cards or biometric authentication for crisis response team members. Document verified contact numbers and communication methods for all authorized crisis responders.
Create simple flowcharts guiding employees through identity verification during high-stress situations
Design clear decision trees posted at workstations and integrated into crisis response systems. Include specific contact numbers and verification questions for different authority levels. Create pocket cards or digital quick-reference guides with verification steps that work even under stress. Make verification procedures feel respectful rather than insubordinate through careful language design.
Conduct quarterly crisis exercises including fake authority scenarios mixed with legitimate crisis training
Design tabletop exercises that test both technical crisis response and authority verification protocols. Include simulated impersonation attempts during crisis drills to teach employees to maintain verification even under pressure. Measure compliance rates and provide immediate feedback. Gradually increase difficulty to build stress inoculation. Celebrate appropriate verification behaviors to build cultural acceptance.
Implement automated monitoring of emergency access usage with real-time alerts and mandatory reviews
Deploy automated monitoring that alerts security teams in real-time whenever break glass access is used. Require mandatory post-incident review within 24 hours verifying the access was legitimately authorized and appropriately scoped. Trend analysis to identify departments or individuals with frequent emergency access usage. Regular executive reporting on break glass access patterns and reduction initiatives.
Establish pre-verified crisis response teams allowing rapid but secure identification during emergencies
Create formal crisis response teams with pre-authorized members. Issue photo identification cards, establish biometric authentication, or implement other verification methods enabling rapid identification during actual emergencies. Maintain updated roster with verified contact information. Regular exercises to ensure team members know each other and can identify impersonators. Clear escalation procedures for situations requiring external expertise.