5.4 Why People, Devices, and Habits Are Risks
The Human Interface
The human is the only interface that ships with authority: employees are expected to act on instructions. Pretexting exploits that default posture. A caller invokes authority -- IT support, the bank, the chief executive's office -- manufactures urgency with a closing window, and leans on social proof and consistency ("your colleague already approved the first one") to collapse verification into compliance. Unlike software, people accept natural-language input and cannot be patched, so the realistic mitigation is changing the decision environment rather than the person.
Cognitive State Is the Vulnerability
Three states decide whether a pretext lands. Fatigue: repeated MFA push prompts become approval spam, and an exhausted user approves anything to stop the noise -- which is why attackers prompt-bomb at shift change or 2 a.m. Urgency: time pressure suppresses the verification callback that would have exposed the fraud, so essentially every social-engineering scenario ships with a countdown clock. Distraction: inattentional blindness and habituation mean a user mid-multitask never actually perceives the warning banner -- the third identical alert this week reads as background noise. Effective social engineering is therefore a timing attack: aim at the overnight prompt, the 5:55 p.m. Friday wire request, the meeting-ping moment.
Devices and Habits Extend the Surface
Habits widen the surface exactly like software does. An end-of-life laptop past security support is an unpatched listener with legs; Wi-Fi auto-connect joins any network wearing the office's name; an unencrypted USB on a keyring carries data the perimeter never sees; a shared calendar publishes every executive meeting title, which becomes next week's phishing script; a personal-cloud OAuth grant approved once is a standing door nobody revokes. Each is a predictable routine an attacker can schedule around. Countermeasures are engineering, not posters: verify-before-act workflows with out-of-band callbacks, number-matching MFA instead of yes-or-no pushes, hardware tokens for privileged roles, device inventory with enforced end-of-life dates, and OAuth consent reviews on the same cadence as access reviews. Awareness reminders do not survive fatigue; enforced procedures do.
Architecture Diagram
Key Takeaways
- People are interfaces with built-in authority -- pretexting exploits authority, urgency, and social proof by design.
- Approval fatigue is a config bug: replace yes/no push MFA with number matching and rate-limit prompts.
- Urgency is the attack payload: any request to skip verification is the tell, not the exception.
- Stale devices, auto-connect, shared calendars, and forgotten OAuth grants are habits attackers schedule around.
- Engineer the decision environment -- verify-before-act, out-of-band callback, enforced device end-of-life -- because awareness does not survive fatigue.