How to protect against an attack where a person claims to be in a position of authority?

Question

In an office if a person approaches an employee and claims to be a new IT staff and to give them access to their computer, what can prevent this kind of attack? I've worked a couple tech support jobs and people are all to happy to hand over their password and laptop when I tell them I'm here to fix it.

Answer 1

as @TerryChia said the correct defence against this kind of attack is strong policies. In this case users should be trained not to provide passwords to people in person or on the phone regardless of what the circumstances are.

If IT need to log in to a users account they should either use something like sudo (for *nix environments) or if that's not available either reset the users password before doing the work and then reset it again afterwards or alternatively they could use an approved remote control mechanism that has strong authentication requirements.

The key is to set policies up in a way that does not encourage people to break them. If it becomes the norm that IT staff are asking users for their passwords then when an attacker does the same thing, the users will just go along with it. However if IT never ask for passwords and it's company policy that they shouldn't, users are far more likely to recognise this as an attack and react accordingly.

As with anything with humans, there's no perfect defence, but correctly designed and implemented policies go a long way to helping.

Answer 2

Train the employees properly.

Teach them the need and importance of verifying a person's identity through some sort of identification method before handing over important information.

No amount of technical measures in place can protect against clueless users. So make sure your users aren't clueless.