Identity, Access & Endpoint Security

Replacing an authentication device can create both account lockout and account takeover risk. Checks to make Verify identity through an approved recovery path, revoke the lost factor and active sessions when warranted, issue a new factor, and review recent sign-in activity. Avoid bypassing controls through an unverified phone request. When to get help...

Some legacy tools still require shared credentials, which make attribution and revocation difficult. Checks to make Document business owner and reason, restrict interactive access, store credentials in an approved vault, rotate after personnel changes, and monitor use. Set a replacement deadline and migrate toward named identities with least privilege....

Disabling a primary account is important, but it may not revoke every path into business systems. Active sessions, cloud roles, personal access tokens, shared passwords, mobile devices, and vendor portals may remain active. A reliable offboarding process maps identities to services and assigns an owner for each removal step. Coordinate the timing...

An unexpected approval request can signal password compromise, push fatigue, or a misconfigured sign-in. Checks to make Tell the user to deny and report the prompt, capture time and application details, review sign-in and MFA logs, and revoke sessions or reset credentials according to response policy if evidence warrants. Verify the report through a...

Early account creation can leave a window for unused access, while late provisioning can prevent a productive start. Checks to make Use an approved identity workflow with a start date, named manager, role-based access, MFA enrollment, and device controls. Delay activation where practical, verify access with the manager, and expire any temporary setup...

An active former employee account may retain access through a missed offboarding step, synchronized identity, or third-party application. Checks to make Confirm identity and departure status through an authorized source, disable sign-in, revoke sessions and tokens, and inspect privileged grants and recent activity. Preserve relevant audit records and...

Attackers may try credentials exposed elsewhere against business services, even when the company system itself was not breached. Checks to make Require MFA, block known compromised passwords where supported, monitor unusual sign-ins, and provide a safe credential reset path. Review session revocation and account recovery controls so a reset does not...

Cloud consoles concentrate powerful access, so weak recovery paths or broad standing permissions can increase impact. Checks to make Require strong phishing-resistant authentication where supported, use separate admin identities, limit standing roles, review break-glass access, and alert on privileged changes. Test recovery controls and keep emergency...