Access Control and Identity Management, 3rd Edition

Organizational Structure and Access Control Strategy

Most organizations are structured as a hierarchy composed of senior management, operational management, and staff. In terms of access control, this hierarchical structure implies that a higher-level employee should have all the access rights that a lower-level employee has, plus some additional rights. A skilled social engineer can exploit this assumption by posing as a high-level executive and then target a lower-level member of the support staff. Support staff members are trained to be helpful, and the target may be intimidated by someone he or she assumes is a high-level executive. These natural tendencies represent an easy opportunity for a social engineering attack. All the social engineer ...