All 100 indicators / Category 1.x: Authority-based
Indicator 1.7
Measures vulnerability to attackers who leverage technical expertise claims to bypass security controls
When employees encounter complex technical problems beyond their knowledge, they often bypass normal security protocols and defer to anyone who sounds technically competent. Attackers exploit this by impersonating IT support, vendors, or technical consultants to gain system access, credentials, or sensitive information.
Cognitive offloading - when individuals encounter technical complexity exceeding their expertise, they automatically transfer decision-making authority to perceived experts, bypassing normal verification protocols. This mechanism operates through epistemic dependence (reliance on others for specialized knowledge) combined with Dunning-Kruger effects where limited technical knowledge prevents evaluation of technical claims. Cognitive Load Theory explains why technical jargon overwhelms processing capacity, forcing reliance on source credibility rather than content evaluation.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Mandatory verification protocols for all technical support contacts exist and are consistently followed. Employees use callback verification to known numbers. Documented evidence of refused suspicious technical requests within last 6 months.
Basic verification procedures exist but aren't consistently followed. Some employees bypass verification under time pressure. Verification protocols only apply to certain types of technical requests but not others.
No formal verification process for technical support contacts. Employees routinely comply with technical requests without verification. Recent incidents show successful social engineering through technical impersonation.
Implement mandatory callback verification system for all unsolicited technical support contacts
Deploy callback verification requiring employees to call claimed organization's main number and request transfer to specific person. Create laminated reference cards with verification steps for all employee workstations. Include verified contact database accessible via company intranet.
Deploy digital approval system requiring supervisor and IT security approval for external technical support requests
Implement automated approval workflow with mandatory 24-hour delay for non-emergency technical access requests. Include multi-party authorization, automated notifications, approval tracking, and audit trail. Exception process requires CISO approval.
Establish single point of contact that logs all external technical support interactions
Create IT helpdesk or security team as mandatory reporting point for all unsolicited technical contacts. Require immediate reporting with central team performing verification and response coordination. Weekly audit of logs to identify patterns.
Conduct quarterly simulated technical support calls and emails targeting different employee groups
Deploy phishing simulation platform with technical authority scenarios. Track compliance with verification protocols and provide immediate feedback. Focus on pressure tactics, urgency claims, and technical jargon. Measure improvement over time.
Create secure, searchable database of legitimate technical vendors and authorized personnel
Build and maintain database including legitimate vendor names, support contact numbers, authorized personnel with photos, and verification questions only real support would know. Make accessible to all employees through company intranet with mobile access.
Require written documentation for all technical support interactions
Mandate documentation via email or ticket system for all technical support interactions including verification steps taken, approvals received, and actions performed. Implement monthly audit of technical support logs to identify patterns and improve procedures.
Develop programs specifically for non-technical staff to confidently verify technical claims
Create simple verification scripts that feel professional rather than questioning competence. Provide decision trees that don't require technical knowledge. Establish organizational culture celebrating appropriate technical verification. Train on recognizing pressure tactics.