1.3 Authority Figure Impersonation Susceptibility

What it is

When employees receive requests from apparent authority figures, they often comply automatically without verification, creating a pre-cognitive vulnerability that attackers exploit through CEO fraud, fake IT support calls, and executive impersonation emails.

Why it happens

Milgram's obedience studies (1974) - 65% compliance with perceived authority. Neurologically, authority perception activates anterior cingulate cortex and reduces prefrontal cortex activity, diminishing critical thinking and risk assessment.

How it is assessed

A quick assessment asks these questions; each answer is scored from resilient to exposed.

Written Verification Procedures for Authority Requests
When employees receive unusual requests (wire transfers, password resets, data access) from apparent executives or IT staff, what is your standard verification procedure?
Emergency Override Frequency
How often do executives or IT staff request to bypass normal security procedures due to 'emergencies' or 'urgent situations'?
Multi-Channel Verification Requirement
What verification methods are required for sensitive requests from authority figures?
Authority Impersonation Training
What specific training do employees receive on how to verify the identity of authority figures making security-related requests?
External Technical Expert Verification
When external technical experts, consultants, or vendors request system access or sensitive information, what verification steps are required before granting access?
Crisis Communication Authentication
During security incidents or crises, who is authorized to give direct orders that bypass normal verification procedures, and how are they authenticated?
Employee Comfort Questioning Authority
How comfortable do employees feel questioning unusual authority requests?
Executive Exception Policies
What written policies exist for when executives can authorize exceptions to standard security procedures?

Reading the result

Resilient

Written verification procedures exist and are consistently followed regardless of apparent authority level. Multiple verification methods required. Regular training includes authority impersonation scenarios.

Partly exposed

Some verification procedures exist but inconsistently applied. Single verification method used. Basic training exists but doesn't specifically cover authority impersonation.

Exposed

No formal verification procedures for authority requests. Employees expected to comply immediately with executive or IT requests. Strong cultural expectation not to question authority figures.

What to change

Dual-Channel Verification Protocol

Require all sensitive requests from authority figures to be verified through a separate communication channel

If email request → verify by phone using known numbers; if phone request → verify by email

Effort: medium | Time to put in place: 30-60 days

Authority Authentication System

Deploy identity verification tools for high-risk requests

Callback verification database with confirmed phone numbers, secure communication channels for executives, MFA for authority requests bypassing normal procedures

Effort: high | Time to put in place: 60-90 days

Crisis Authority Protocols

Establish pre-authorized crisis response teams with clear authentication procedures

Pre-authorized incident response roster, verified contact methods for legitimate vendors, explicit policies that verification remains required during emergencies

Effort: medium | Time to put in place: 45 days

Authority Impersonation Training

Implement role-playing simulations where employees practice verifying apparent authority figures

Teach specific verification scripts that feel respectful rather than insubordinate, create organizational culture celebrating appropriate security verification

Effort: low | Time to put in place: 30 days initial, ongoing

Executive Exception Management

Create formal approval workflows for any security exceptions

Require documented business justification and security review for executive overrides, implement logging/monitoring of all exception requests with regular review

Effort: medium | Time to put in place: 45 days

Psychological Safety Programs

Develop explicit organizational policies protecting employees who verify authority

Create positive recognition programs for appropriate security verification behaviors, train leaders to model and encourage verification rather than viewing it as questioning authority

Authority Figure Impersonation Susceptibility