Help desk deepfakes: Why CISOs must rethink verification

Keeping calm under pressure

Help desk calls are driven by urgency -- an employee who needs to reset their password or has lost access to a business-critical tool must regain access as soon as possible in order to do their job. Help desk requests from someone with authority, such as a CEO, add to the urgency.

"A caller who is rushed, senior and annoyed is exactly the profile to slow down for," Perreault said. This is especially risky for the hospitality industry, he said, where employees work around the clock across multiple properties. "We center hospitality in everything we do, which can make saying 'no' to a frustrated caller feel wrong."

Deepfakes are often too convincing to detect by ear, Perreault warned. Instead of teaching employees to identify a fake, organizations should create a verification process that works regardless of how good the deepfake is. This includes allowing help desk employees to tell callers they will return the requester's call at a trusted callback channel, which has additional verification.

At High Touch Technologies, an MSP based in Wichita, Kan., Director of Information Security Jason Fenoglio said the biggest change to its security strategy was adopting a new policy that requires help desk employees to contact an employee with approval authority to verify any request involving finances or intellectual property.

"A voice call, video call or email doesn't count as approval, however real it seems," Fenoglio said. "Deepfakes depend on urgency and apparent authority, and this rule removes them both."

Fenoglio said the company also implemented security awareness training on identifying deepfakes, including warning signs and the challenges of reliably detecting them. However, help desk employees must follow the verification process every time, even if a caller sounds legitimate.

Help desk staff also perform exercises that simulate real-life scenarios, such as a CEO calling for an urgent MFA reset, which helps employees slow down and complete the verification process under pressure, he said.

"Train your help desk to understand that if someone is rushing you to get something done, it's a red flag," McGlasson said.

Zero-trust approach

Aside from training, the most effective way to prevent a deepfake attack is to use zero-trust to ensure no user is trusted by default.

"The phrase to watch for in 2027 would be zero-trust identity recovery," said Daniel Di Nardo, network and security consultant at cybersecurity vendor IntelliBreach.

Too many help desk processes revolve around recognition, such as a known phone number or familiar voice, he said. But those are no longer effective authentication factors -- even known phone numbers can be spoofed and rerouted. Instead, he advocates for help desks having independent, out-of-band and preconfigured mechanisms.

In practice, Perreault said, this means only allowing managed and compliant devices, tying access to roles, using application allowlisting and moving toward phishing-resistant MFA, such as passkeys and FIDO2, so a reset alone isn't enough for an attacker to take over an account.

"Software that isn't approved simply doesn't run, even if the attacker gets a foothold," he said.

Metrics to measure mitigation

CISOs should continue to monitor the help desk to ensure staff follow the verification process. Fenoglio said CISOs should track the following key metrics:

• The percentage of sensitive requests completed with documented out-of-band verification, such as resets, MFA changes and payment changes.
• How many simulated impersonation exercises were caught, escalated or bypassed.
• The number of suspicious requests reported by employees.
• Exceptions made to the verification policy and the reason for each.

"We review the exceptions most closely because they show where people aren't following the process," Fenoglio said.

At NDM Hospitality and Rentyl Resorts, Perreault said key metrics to ensure a deepfake mitigation strategy is working include the following:

• Percentage of resets and access changes completed through out-of-band verifications.
• The number of requests that were escalated or refused.
• Pass rates on simulated social engineering calls and emails.
• How quickly access is revoked when someone leaves the company or a device is lost.
• Audits of phishing-resistant MFA.

Deepfake attacks will only become more common as they become cheaper to create, Fenoglio added. Attackers pairing deepfakes with stolen data will be even harder to spot -- and organizations that rely on detection alone are at risk.

"Trusted callback channels, approval workflows and identity controls hold up better because they don't depend on how someone looks or sounds," Fenoglio said. "That's why we built our approach on process and policy rather than detection."

Katherine Finnell is senior editor for TechTarget Cybersecurity. She writes and edits articles on a variety of cybersecurity technology topics, including AI and CISO strategy.