OM-BP-0025: Reset all credentials and secrets following a breach

Best Practice

Reset all potentially compromised credentials and secrets, including service account passwords, integration keys, especially MFA’s, following a suspected or confirmed data breach or compromise of these credentials or secrets.

Rationale

As shown in Cash et al., 2020, an attacker may steal MFA integration secrets during an attack, in this example on OWA, allowing him to silently bypass the MFA protection after the incident and re-compromise the organization.

Bad Practices

• Failure to exhaustively reset potentially compromised credentials or secrets following a suspected or confirmed compromise

Implementation Details

• Make an exhaustive inventory of potentially compromised credentials and secrets.

• Reset all of them.

• Set up adequate monitoring use cases, including MFA bypass monitoring.

Quotes

Bibliography

• Cash et al., 2020

• Goodin, 2020

Related Best Practices

• OM-BP-0018: Protect MFA integration secrets (Best Practice)

See Also