Resource Downloads
Google Slides | Microsoft PowerPoint | PDF Presentation
Injection
Fred from HR calls the helpdesk to report that they entered their credentials on a website that they now think was fake.
Discussion Prompts
- How do you determine if this is a confirmed security incident or some kind of anomaly?
- How do you identify what systems, data, people, and operational processes are potentially involved?
- What real or potential risk(s) does your organization face?
- What short term containment options do you have?
- Can you contain it without destroying evidence?
- What is the operational impact of the incident and your containment strategy?
Check Your Work
- Thanking Fred for Calling
- Compromised Account Containment
- End sessions
- Revoke tokens
- Force password change
- Force MFA
- Check email for rules or delegation changes.
- Ask user to change PW is used on other accounts (business or personal).
- Review Activity
- Access Logs
- VPN Connections
- Impossible travel
- How much time did you spend on investigation before you changed passwords, etc.?