All tabletop exercises
Identity·Intermediate·Technical audience
MFA fatigue: a finance clerk taps Approve
The prompt — read this to the room
At 22:47 a payables clerk receives 31 MFA push requests in eight minutes. On the 32nd, half asleep, she taps Approve. By the time she reports it next morning, the account has signed in from a hosting provider, registered a new MFA device and created an inbox rule that moves any email containing 'invoice' or 'payment' to an obscure folder. Two supplier payment runs are scheduled for 11:00 today. Your SOC saw the overnight push alert and closed it as user error. What do you do before 11:00?
Total duration
1 h 30 min
People to involve
5
Best fit
Finance, Manufacturing
Who to involve
Most important first.
- SOC analyst
- Incident response lead
- IT operations
- CISO / Head of security
- CFO / Finance
What it tests
- Contain the account fully: sessions, registered devices, mailbox rules and app consents.
- Find out whether payment instructions were changed and protect the 11:00 runs.
- Understand and fix the triage failure that closed the overnight alert.
- Decide on number matching, push rate limits and phishing-resistant MFA for high-risk roles.
Outline of activities
- 1The morning report and the closed alert
- 2Containing the account
- 3Protecting the 11:00 payment runs
- 4Why the SOC closed it
- 5Control decisions and hot wash
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…