The Attacker Did Not Break In, They Called the Service Desk

We spent that year hardening everything with a technical surface. Multi-factor everywhere, conditional access, patching cadence tightened, external attack surface reviewed quarterly. Then somebody phoned the service desk, said they were a field engineer who had dropped their phone in a car park, sounded credibly stressed, and had a valid employee number and a manager's name that matched our public org chart. The agent reset the authenticator enrolment. It took four minutes and it defeated every control we had bought.

What bothers me is that the agent did nothing wrong by our own rules. The process for a lost device explicitly existed. It required an employee number and a callback to a number on file, and the caller had a plausible answer for why the number on file was unreachable, which the process allowed the agent to accept at their discretion. The exception was written into the procedure because without it, genuinely stranded staff would be locked out for a day. So the control had a documented hole in it and we had never modelled who might walk through.

The uncomfortable part of service desk security is that the desk is measured on the opposite of suspicion. Their targets are resolution time and satisfaction. Every incentive we place on that team rewards being helpful and fast to someone who sounds like a colleague in trouble. Then we act surprised when helpfulness is the exploited path.

What we changed was mostly about removing the agent's discretion at the point of pressure. Identity-affecting actions now require verification through a channel the caller cannot choose, usually a manager confirmation in a system the manager has to log into, or an in-person check for staff on site. Agents are explicitly authorised to say the request will take an hour, and nobody is penalised for that hour. We also started running the scenario, calling our own desk a few times a quarter, and telling the team afterwards, including when they got it right.

We had assumed the human path was covered because there was a written procedure for it. A written procedure is not a control. A control is something that still holds when the person following it is being rushed by someone who sounds like they need help.

– Serguey Shinder