All 100 indicators / Category 8.x: Unconscious process
Indicator 8.8
Measures vulnerability to unconscious archetypal patterns that bypass security protocols when triggered by symbolic messaging
Archetypes are universal psychological patterns inherited in the collective unconscious that automatically evoke powerful emotional and behavioral responses. When attackers use archetypal themes—'be the hero,' 'urgent authority request,' 'clever workaround'—they trigger pre-cognitive responses that override rational security thinking. Digital environments, being transitional spaces between reality and imagination, create ideal conditions for archetypal projection and activation.
Jung's (1969) analytical psychology demonstrates archetypes as universal patterns bypassing ego defenses.System 1 processing dominates archetypal responses, creating compelling urges to act before conscious security awareness intervenes (Kahneman, 2011).
A quick assessment asks these questions; each answer is scored from resilient to exposed.
Formal verification procedures consistently followed regardless of emotional appeals. Documented processes require multiple approvals for security exceptions. Incident reports show technical failures rather than psychological manipulation. Regular training addresses emotional manipulation tactics. No authentication bypasses due to urgency in past 90 days.
Some emergency override procedures exist but lack consistent enforcement. Authority-based exceptions occur monthly but are eventually verified. Hero behavior sometimes rewarded despite security violations. Clever workarounds tolerated in low-risk situations. Mixed success resisting archetypal manipulation.
Frequent emergency overrides with minimal verification. Authority figures easily bypass security through status alone. Individual heroics celebrated over process compliance. Clever rule-breaking culturally rewarded. Trust-based decisions common with minimal verification. Archetypal themes dominate security incident patterns.
Implement mandatory 60-second pause and second-person verification for any request using emotional language
Create decision tree for common scenarios requiring verification. Include automated delay in critical systems for any override attempts. Train recognition of 'urgent,' 'emergency,' 'help,' and 'authorized' trigger words.
Establish clear verification procedures for all authority-based requests
Callback verification using independently sourced contact information. Two-factor confirmation for security exceptions. Train staff that real executives support security verification procedures.
Create legitimate channels for employees to 'save the day' through proper security reporting
Publicly recognize employees following security procedures during high-pressure situations. Establish 'Security Hero of the Month' program rewarding process compliance over individual heroics.
Implement formal review for creative technical solutions impacting security
Create innovation sandbox where clever ideas tested safely before production. Establish 'Secure Innovation' guidelines celebrating cleverness while maintaining controls.
Deploy scenario-based training focused on verification procedures regardless of trust feelings
Create simple 'Trust but Verify' checklist for common social engineering scenarios. Include monthly simulation exercises using trust-based manipulation techniques. Emphasize that verification shows respect, not distrust.
Implement automated monitoring of internal communications for archetypal trigger language
Create alert system for security team when emergency/authority/hero language appears in unusual contexts. Develop response protocols for each identified pattern type. Privacy-preserving aggregate analysis only.