Exercise 2: Why "Dana from Accounting" Is High-Risk Despite a Casual Tone — Possible Solution ==================================================================== WHAT'S ACTUALLY BEING REQUESTED ------------------------------ Stripped of its friendly phrasing, the message asks for a password to be disclosed directly. Per the chapter's own risk table, a credential disclosure sits in the same tier as "password reset, access grant, or disabling a security control" - the high-risk tier, regardless of how the request is worded. WHY TONE DOESN'T CHANGE THE RISK TIER ------------------------------ Per this chapter, "the risk tier is set by what's being asked for, not by how the request is phrased." A casual tone, a first-name introduction, and a stated deadline are all *presentation* - they describe how the request feels to receive, not what would actually happen if it were granted. Whether the request arrives urgently or politely, disclosing a password to an unverified requester carries the same consequence either way. WHY A CASUAL TONE IS SPECIFICALLY DANGEROUS HERE ------------------------------ A friendly, low-pressure tone can actually work against caution more effectively than an aggressive one, precisely because it doesn't trigger the same defensive instinct a hostile or obviously suspicious request would. The chapter's own tip-box states this directly: "tone is not a risk signal - the request itself is." Judging risk by tone would mean the friendliest-sounding attacks are systematically the ones that get the least scrutiny, which is backwards. WHY THIS MATTERS FOR CONSISTENT APPLICATION OF CHAPTER 4's TIERS ------------------------------ If risk tier depended partly on tone, the same underlying request (disclosing a credential) could get wildly different treatment depending only on how it was phrased - which defeats the point of having a risk-based system at all. Tying the tier strictly to the nature of the request, not its wording, keeps the system consistent. WHY THIS WORKS AS AN ANSWER ------------------------------ It identifies the actual request underneath the friendly phrasing, explains why the chapter ties risk tier to the request itself rather than tone, and explains specifically why a casual tone is dangerous precisely because it doesn't feel high-risk.