Technician Impersonation
He has a toolbox, a badge and two minutes. Check anyway.
What Is Technician Impersonation?
Impersonating a maintenance engineer costs a toolbox, a lanyard and a plausible fault to fix. The request that follows is always the same: a few minutes on a machine that is already signed in. In this exercise a contractor asks for exactly that, produces a work order number when you challenge him, and waits while you check it. You practise reading a badge, verifying a visit with the team that would have booked it, refusing the session, and reporting the attempt.
What You'll Learn in Technician Impersonation
- Recognize a request to work from an employee's signed-in session as the thing a genuine engineer never needs
- Read a contractor badge as a record of arrival rather than confirmation that a visit was booked
- Verify a quoted work order number with the service desk instead of accepting it as an answer
- Resist time pressure that is aimed precisely at the couple of minutes a check would take
- Report an attempt that failed, so the desks and floors the visitor moves on to are already warned
Technician Impersonation — Training Steps
-
A Printer Nobody Can Fix
It is a grey Wednesday morning at Penrow Analytics. Alice is halfway through rebuilding a quarterly report, with the third-floor print queue stuck behind her for the second day running. The service desk sends round its usual morning note.
-
Someone At Your Shoulder
At a quarter to ten a man in a hi-vis vest comes up the stairs with a toolbox in one hand and a lanyard swinging from his neck. He does not stop at the front of the floor. He walks the length of it and stands behind Alice's chair, close enough to read her screens.
-
The Pitch
He is friendly, unhurried in manner and hurried in content, and he knows exactly which fault to name.
-
Read The Badge
Before answering, look at what he is wearing. The lanyard is the only thing on this floor that claims to say who he is and who sent him.
-
What Do You Say?
Tessmark Field Group is not a name Alice has heard before, though there is no reason she would know every subcontractor the building uses. The fault he named is real, the queue behind her has been stalling for two days, and he is waiting with his hand out for a keyboard.
-
He Has A Number
The question does not throw him. He answers it, which is the point of carrying a number in the first place.
-
Check It With IT
A number said out loud is worth nothing until somebody looks it up. The service desk raises the work orders and books the visits, so they are the only people who can settle this. Alice turns to her screen and asks them, with Gary still standing behind her chair.
-
What IT Says
Roan answers before Alice has finished reading her own message back.
-
Turn Around And Answer
Gary is still there, still waiting, still pleasant about it. There is nothing to argue over and nothing to prove. The check came back empty, and that is the whole answer.
-
Suddenly Busy
The friendliness stays. Everything else about him changes.
Security Framework Coverage
MITRE ATT&CK
- T1656 Impersonation
CIS Controls
- CIS 14.2 Train Workforce Members to Recognize Social Engineering Attacks
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind