All tabletop exercises
Identity·Intermediate·Mixed audience
The help desk resets the wrong person's MFA
The prompt — read this to the room
On Tuesday afternoon, a caller claiming to be a regional sales director phones the IT help desk from a number that is not on file. He sounds stressed, says he has a new phone and is about to present to a major customer, and knows his employee ID and his manager's name. The agent resets his MFA and sends a temporary password. Ninety minutes later the real director, sitting in your office, gets a sign-in alert. Since then the account has opened the CRM and the shared drive for an acquisition project. What now, and how did this get through?
Total duration
1 h 30 min
People to involve
6
Best fit
Any sector
Who to involve
Most important first.
- Customer support
- IT operations
- SOC analyst
- Incident response lead
- CISO / Head of security
- HR
What it tests
- Contain an account takeover that began with a legitimate reset.
- Review help-desk identity verification and decide what changes today.
- Scope data access, including confidential acquisition material, and decide who must be told.
- Support the agent while fixing the process that let the call succeed.
Outline of activities
- 1The sign-in alert and the ticket
- 2Containing the account
- 3What the attacker saw
- 4Fixing verification at the help desk
- 5People, process and hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…