Assess whether attribution is good enough to name an actor (d17c99)

Situation

A law firm with a client-matter data store cannot treat a help-desk reset that bypassed step-up authentication as color commentary on over-privileged service account in production. Cloud-security architect must close attribution is good enough from that extract under Cybersecurity / Exposure Management.

Decision

Cloud-security architect in a law firm with a client-matter data store must choose Contain now / Monitor / Escalate / Hold using over-privileged service account in production after a help-desk reset that bypassed step-up authentication.

Hypotheses to test

• Cloud-security architect can defend Contain now from over-privileged service account in production after a help-desk reset that bypassed step-up authentication in a Cybersecurity challenge.
• Cloud-security architect cannot defend Contain now from over-privileged service account in production; Monitor is what the extract actually supports after a help-desk reset that bypassed step-up authentication.
• A help-desk reset that bypassed step-up authentication never reached the population in over-privileged service account in production — reopen intake, do not close attribution is good enough.
• Two facts in over-privileged service account in production after a help-desk reset that bypassed step-up authentication conflict for cloud-security architect; hold this Exposure Management file.

Analysis required

• Map identities, standing privileges, and last-use timestamps in over-privileged service account in production to the blast radius of a help-desk reset that bypassed step-up authentication.
• Name the compensating control that would let cloud-security architect release a reversible hold.
• Test whether access is still live, already rotated, or only written as closed.
• For this Cybersecurity Exposure Management file, read over-privileged service account in production against a help-desk reset that bypassed step-up authentication and write the one fact that would move attribution is good enough for cloud-security architect.

Recommendation

Choose Contain now / Monitor / Escalate / Hold on this Cybersecurity / Exposure Management packet (over-privileged service account in production after a help-desk reset that bypassed step-up authentication). If over-privileged service account in production cannot force a Cybersecurity label under Exposure Management, stop. If over-privileged service account in production after a help-desk reset that bypassed step-up authentication cannot support Contain now versus Monitor on this Cybersecurity Exposure Management close, cloud-security architect must keep the hold until identity, privilege, and last-use evidence can be re-performed.