Nine Days Undetected: Responding to a Credential Phishing Compromise
A 600-employee software company runs a legacy VPN without multifactor authentication for remote engineering staff. A phishing campaign harvested 40 sets of credentials; the attacker logged in over nine days, accessed three code repositories, and downloaded HR files containing employee bank details for direct deposit. The intrusion was found only when an engineer noticed an unfamiliar login location. The CISO is on leave; the IT director wants to quietly reset passwords over the weekend and 'see if anything else happens.' The company has customer contracts requiring notification of security incidents within 72 hours, and the HR files may trigger state breach-notification laws.
1. What is the correct containment and investigation sequence, and what must not be done?
Read the worked answer
Contain without destroying evidence. In order:
- Activate the incident response plan and name an incident commander - the IT director can hold it, but the role and authority must be explicit.
- Preserve evidence: capture VPN, authentication, and endpoint logs; snapshot affected repositories and mailboxes; start a timeline. A weekend password reset without log preservation is the single most damaging move available here.
- Contain: disable the 40 compromised accounts, revoke active sessions and tokens (not just passwords - tokens survive resets), block the source infrastructure, and force re-authentication.
- Scope: hunt for persistence - new accounts, API keys, OAuth grants, scheduled tasks, mailbox rules, and access to build pipelines. Code repositories are a supply-chain risk, not just data loss.
- Eradicate and recover: rotate credentials and secrets that touched the affected systems, including code-signing and deployment keys.
What must not be done: quiet resets without forensics, unilateral decisions by IT without legal and executive involvement, or communicating with customers before the facts are scoped and counsel is engaged.
2. Who decides on notification, and how do you build that decision?
Read the worked answer
Notification is a legal and business decision, not an IT one. Convene counsel, HR, and executive leadership immediately.
The analysis: (1) What data was actually exfiltrated? HR bank details are personal information likely covered by state breach laws with tight deadlines; determine residency of affected employees. (2) Do customer contracts impose 72-hour notice - does the clock run from discovery, and does 'discovery' mean the engineer's alert? Treat the discovery date conservatively. (3) Are there sector regulators or insurers with notice conditions?
Build a written decision memo: facts known, facts unknown, legal exposure, contractual exposure, reputational exposure, and recommended action with a timeline. Where law requires notice, send it; do not delay for a perfect forensic picture. Where notice is discretionary, weigh customer trust against premature alarm.
Prepare the communications before you need them: employee FAQ, customer notice template, and a single spokesperson. Avoid speculation in writing.
3. What governance changes would prevent a repeat, and how do you sequence them against cost?
Read the worked answer
The root causes are structural, not technical exotica: no MFA on remote access, excessive standing privilege, and no detection.
Sequence by risk reduction per dollar:
- Immediate (low cost): enforce MFA on VPN and all internet-facing services; conditional access and geo-velocity rules; disable legacy protocols; shorten session lifetimes.
- Near term: least privilege and just-in-time admin access; privileged access management for service accounts and secrets; centralized logging with alerting on impossible travel, mass download, and new OAuth grants.
- Medium term: network segmentation for repositories; egress filtering; data loss prevention on HR and source code; phishing-resistant authentication for engineers.
- Program: tabletop exercises, an on-call incident roster with a named alternate when the CISO is away, and a documented decision log.
Present as a tiered plan with cost and residual risk, so leadership can choose. The CISO's absence is itself a finding - no plan should depend on one person being available.