Impersonation
What is Impersonation?
A social engineering technique where an attacker pretends to be a trusted individual or authority figure to manipulate victims into revealing information.
Terms that appear alongside impersonation
Each of these is named in at least one of the same controls as impersonation. The number is how many controls name both.
- phishing 8 shared controls
- authentication 6 shared controls
- nist 5 shared controls
- identity proofing 4 shared controls
- insider threat 3 shared controls
- cybersecurity 3 shared controls
- consent 3 shared controls
- ransomware 2 shared controls
Frameworks that govern impersonation
What the standards actually require on impersonation
Requirements naming impersonation across 6 standards, quoted from the control text.
Implement AAL3 authentication per NIST SP 800-63B Section 4.3. AAL3 requires (a) Multi-Factor Cryptographic Hardware authenticator OR Single-Factor Cryptographic Hardware combined with a memorised secret OR Multi-Factor One-Time Password Device combined with a...
NISTSP63-6 · AAL3 Authentication: Hardware Cryptographic, Verifier Impersonation Resistance, Phishing Resistance →Where software allows user impersonation, sensitive data is not logged and appropriate permissions are set.
ISM-2046 · Logging and permissions for user impersonation →Investigators appointed by the Secretary carry identification and may enter premises (other than residential premises without consent or a warrant) at reasonable times to inspect goods, documents and equipment, may execute search warrants, and may by written n...
nsw-fair-trading-act-1987::18-23 · Investigators: entry, search, production of information and documents; no obstruction or impersonation →Maintain a published policy prohibiting misrepresentation of identity such as impersonation and defining impermissible bot use (such as manipulating trends or artificially boosting content or accounts);
singapore-protection-from-online-falsehoods-and-manipulation-act-pofma-2019::OA-6a · Online Accounts Code 6(a) to (c) Publish a policy against impersonation and manipulative bot use; verify accounts and re-verify on suspicious activity →Where users authenticate while physically interacting with the TOE, the package adds threats of masquerade and impersonation, an assumption of secure authentication credentials, an objective of identification and authentication of users with an environment obj...
etsi-industry-specification-group-isg-on-quantum-key-distribution-qkd::016.PKG.4 · 016.PKG.4 Package: local authentication of users →Control: provide adequate controls for users to identify and authenticate the telecommunications organization. Purpose: to ensure users connect to the correct provider and to prevent unauthorised access to services.
iso-iec-27011-2024::8.35 · TEL: Telecommunications carrier identification and authentication by users →Questions people ask about impersonation
What is Impersonation?
Why is Impersonation important for compliance?
Which compliance frameworks address Impersonation?
Where can I learn more about Impersonation?
See how Impersonation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.