Preventions

ID: PV070
Created: 08th September 2025
Updated: 08th September 2025
Contributor: The ITM Team

Service Desk Caller Verification Process

This prevention mandates a standardized, enforceable identity verification process for all service desk interactions involving password resets, account unlocks, or access changes. It requires the use of multi-factor authentication (MFV), out-of-band confirmation (OOB), and structured workflow enforcement to ensure caller legitimacy. The process reduces susceptibility to impersonation, prevents policy bypass under pressure, and ensures auditability for investigative review.

Prevention Measures

All verification must use at least two distinct factors:

A knowledge factor (e.g., pre-set PIN or a dynamic question).
A possession factor (e.g., one-time passcode sent to a pre-registered corporate channel such as email or SMS).

For high-risk accounts, apply out-of-band confirmation:

Perform a callback to a pre-registered phone number.
Or request confirmation via an internal messaging platform (e.g., Microsoft Teams or Slack).

Verification steps must be enforced within the IT Service Management (ITSM) platform:

Each verification checkpoint is prompted and must be completed before proceeding.
Agents cannot override or skip steps manually.
All actions must be logged automatically with time, actor, and outcome.

Escalation protocols must be followed when:

Verification fails.
A request seems inconsistent or suspicious.
The subject is flagged in HR systems as inactive, offboarded, or under restriction.

Logs must include:

Requestor’s claimed identity.
Verifier’s identity.
Verification methods used.
Outcome of each step.

Service desk staff must undergo regular training and social engineering simulations:

Focus on red flags such as urgency, executive name-dropping, or vague justifications.
Reinforce the principle: verification is mandatory, regardless of pressure.

Sections

ID	Name	Description
IF013	Disruption of Business Operations	The subject causes interruptions, degradation, or instability in organizational systems, processes, or data flows that impair day‑to‑day operations and affect availability, integrity, or service continuity. This category encompasses non‑exfiltrative and non‑theft forms of disruption, distinct from data exfiltration or malware aimed at permanent destruction. Disruptive actions may include misuse of administrative tools, intentional misconfiguration, suppression of services, logic interference, dependency tampering, or selective disabling of critical functions. The objective is operational impact; slowing, blocking, or misrouting workflows, rather than data removal or theft.
PR027.005	Service Desk Impersonation for Credential Manipulation	The subject deliberately impersonates a member of the organization—typically a colleague, manager, or IT representative—or otherwise misrepresents themselves in order to manipulate service desk staff into resetting a password, unlocking an account, or granting access to a system. These requests are framed to appear legitimate and urgent, often exploiting common support workflows or pressure tactics (e.g., deadline stress, executive impersonation). This behavior is especially dangerous because it abuses internal trust pathways and bypasses traditional authentication, detection, or technical controls. It can occur via phone, email, chat, or in-person interaction and is frequently used in preparation for unauthorized data access, surveillance, or exfiltration.
IF013.002	Operational Disruption Impacting Customers	The subject deliberately interferes with operational systems in ways that degrade, interrupt, or misroute services relied upon by customers, without relying on file deletion or malware. This includes misconfigurations, service disabling, authentication interference, or intentional introduction of latency, instability, or incorrect outputs. The result is operational degradation that directly or indirectly affects service delivery, availability, or trust. Unlike File or Data Deletion, this infringement does not depend on erasing data, and unlike Destructive Malware Deployment, it does not rely on malicious payloads or automated damage. The disruption instead stems from direct manipulation of infrastructure, configurations, service states, or user access. Examples include: Intentionally disabling authentication or API endpoints Modifying DNS, firewall, or routing rules to block legitimate traffic Tampering with load balancers or HA/failover logic Altering service configurations to break dependency chains (e.g. pointing production systems to empty dev databases) Injecting false flags into monitoring or orchestration tools to trigger auto-scaling failures or mis-alerts Enabling excessive logging or computation to induce service latency or memory exhaustion Locking critical service accounts, API keys, or secrets in vault systems These actions may be motivated by retaliation, concealment, sabotage, or insider coercion, and often occur in environments where the subject has legitimate system access but uses it to destabilize service delivery covertly.