SE-A-03Level 1 · Signal
Can reset passwords or MFA for others
- Access
- Neutral
- Level 1 · Signal
An access signal from the IT service management system: the person holds a help-desk or admin role that can reset other people's passwords or MFA factors.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.AA-05
- MITRE ATT&CK
-
- T1098.005
The definition, in detail
Definition
Pretexting this person gives an attacker someone else's account.
Example
A service-desk analyst takes a call from someone claiming to be a traveling executive who lost his phone and needs MFA re-enrolled before a board call.
How it is measured
- Source
- IT service management
- Subject
- Person
- Event
- Help-desk role
- Risk domain
- Social engineering
- Provenance
- Verizon DBIR, Framework research
How it is used
Programs count "Can reset passwords or MFA for others" per person from IT service management and read it beside the other Social engineering signals; it feeds 1 cohort, 1 sequence and 2 breach scenarios.
A "can reset passwords or MFA for others" record is evidence of what the person could expose (the access side of the model). It describes reach; it records no action by the person and no attack under way.
Technical mappings
Framework mappings; validate for your use case.
Continue exploring
"Can reset passwords or MFA for others" (SE-A-03), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/se-a-03-can-reset-passwords-or-mfa-for-others
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.