Chapter 20 — Recovery and lost devices

Chapter 20 — Recovery and lost devices

Lesson map

Lesson 20 published. Map, example, EX058.

flowchart TD
  N0["Learning outcomes"]
  N1["20.1 Recovery design"]
  N2["20.2 Lost devices"]
  N3["20.3 Avoiding weak points"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX058"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["20.1 Recovery design"]
  N2["20.2 Lost devices"]
  N3["20.3 Avoiding weak points"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX058"]

[Learning outcomes]
    |
    v
[20.1 Recovery design]
    |
    v
[20.2 Lost devices]
    |
    v
[20.3 Avoiding weak points]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX058]

Learning outcomes

You will (1) design account recovery; (2) handle lost authenticators; (3) avoid recovery becoming a weak point.

20.1 Recovery design

Staff lose phones and forget PINs, so recovery must work, but it must not be easier to misuse than normal sign-in. NIST SP 800-63B treats account recovery as part of authentication strength. Kai's process requires a staff member to contact IT, with their manager confirming their identity in person or by video, before a temporary access pass is issued. The pass works once, for a short time, and only to register a new authenticator. Kai writes the process as a runbook. Managers receive a short guide to their part.

20.2 Lost devices

When a phone is lost, the staff member reports it, IT removes its authenticator registration and, for managed phones, locks or wipes it. Kai keeps a backup method for each person, such as a second key in a locked drawer at their clinic, so they can work while a replacement is set up. Over six months there are 9 recovery requests; all are completed within a working day with manager confirmation. Backup keys are listed in the register so they can be found and checked.

20.3 Avoiding weak points

Help desk recovery is a common target for tricking staff, so Kai's process never resets based on a phone call alone, and IT never asks for or accepts the staff member's password. Security questions are not used, because answers are often guessable. Recovery events are logged and included in monthly reviews. A strong sign-in with a weak recovery would leave the overall protection only as strong as the weaker of the two. Kai explains these rules to staff so they understand why IT asks for manager confirmation. Staff then accept the small delay.

Worked example

Nine recovery requests in six months are completed within a working day, each with manager confirmation and a one-time pass.

Synthetic case. Requests and processes are synthetic; NIST SP 800-63B is a real source.

Errors and limits

Resetting authenticators based on a phone call alone makes recovery the weakest point.

Exercises

• EX058 — Temporary pass. What can the temporary pass do? Rubric: 3 = once, briefly, register a new authenticator;; 2 = register;; 1 = everything;; 0 = none.
• EX059 — Security questions. Why are security questions not used? Rubric: 3 = answers are often guessable;; 2 = guessable;; 1 = slow;; 0 = none.
• EX060 — Request count. How many recovery requests occurred in six months? Rubric: 3 = 9;; 2 = nine;; 1 = 90;; 0 = none.

Synthesis

Recovery with manager confirmation and one-time passes keeps protection strong when devices are lost.

Continue studying — chapter 20 of 30

← Chapter 19 (draft) · Course chapter index · Chapter 21 (draft) →