All 100 indicators / Category 3.x: Social influence
Indicator 3.4
Measures vulnerability to attackers who exploit rapport, similarity, and liking to bypass security verification and decision-making processes
When employees develop positive rapport with individuals—through perceived similarity, attractiveness, or reciprocal interest—they become more likely to trust and comply with requests, creating a neurochemical vulnerability that attackers exploit through social media reconnaissance, rapport-building techniques, and extended engagement campaigns.
Cialdini's Liking Principle (1984) - people say yes to those they like. Neurologically, positive social interactions trigger oxytocin and dopamine release while suppressing amygdala threat detection, creating trust bias that overrides security protocols. Attachment theory explains rapid bonding through similarity and reciprocity.
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Relationship-independent verification protocols consistently applied. Social media monitoring prevents reconnaissance. Training includes rapport detection and Kevin Mitnick-style social engineering scenarios. Personal relationships do not override security procedures.
Some awareness of liking-based attacks but inconsistent verification when rapport exists. Limited social media monitoring. Basic training exists but doesn't specifically cover rapport-building attacks or similarity exploitation.
Strong cultural emphasis on being friendly and helpful. No protocols for relationship-independent verification. Social media profiles expose extensive personal information. Employees view skepticism of friendly individuals as rude or paranoid.
Implement verification procedures that explicitly apply regardless of relationship quality, familiarity, or liking
Policy stating 'verification is required even for long-term trusted contacts when requests are unusual'; automated systems require verification checkboxes before sensitive actions
Monitor employee social media exposure and provide privacy guidance to reduce reconnaissance surface
Regular social media profile audits, privacy best practices training, automated monitoring for high-risk information disclosure
Comprehensive training on Kevin Mitnick-style rapport attacks including similarity exploitation, extended engagement, and neurochemical trust bias
Quarterly simulations of rapport-building attacks, training on oxytocin/dopamine manipulation, similarity recognition exercises
Deploy behavioral analytics to detect long-game social engineering campaigns building rapport over weeks or months
Monitor external communication patterns, flag gradual relationship building before sensitive requests, analyze sentiment progression
Establish security procedures for conferences, networking events, and in-person rapport building
Pre-conference briefings, information disclosure limits, post-conference verification requirements for new contacts, badge scan tracking
Train employees to recognize and resist similarity exploitation and reciprocity manipulation
Specific modules on Cialdini's liking principle, similarity markers (alma mater, hometown, hobbies), attractiveness halo effects
Build organizational culture that balances friendliness with security skepticism without conflict
Leadership communication that verification is respectful not rude, recognition programs for maintaining security with friendly individuals, 'trust but verify' cultural messaging