Helpdesk MFA Reset and Business Email Compromise
Ridgeway Financial has 450 employees. MFA is enforced for VPN and Microsoft 365, but the helpdesk can reset MFA after a phone call. At 16:40 a caller claiming to be the CFO's assistant asks the helpdesk to reset the CFO's MFA because the CFO lost her phone while traveling. The caller knows the last four digits of the CFO's corporate card and her travel dates, and the call appears to come from the assistant's desk number. The helpdesk resets MFA and enrolls a new authenticator. At 17:02 FortiAnalyzer shows a successful VPN login for the CFO from Romania; her normal location is Dallas. FortiMail shows six outbound messages with the subject Updated bank details to three vendors. Outbound DLP is not enabled. The CFO is unreachable on her known mobile number.
1. What incident are you dealing with, and what immediate containment actions do you take in parallel?
Read the worked answer
This is a business email compromise and account takeover enabled by helpdesk social engineering. Contain in parallel: disable the CFO account and revoke all sessions and refresh tokens; reset the password; remove the attacker-enrolled MFA method; block the source IP and any attacker infrastructure; quarantine or recall the six outbound messages; notify the three vendors and accounts payable by phone; and preserve FortiAnalyzer, FortiMail, and identity-provider logs. Check mailbox forwarding rules, delegate access, OAuth application grants, and inbox rules. Contact the CFO through a known alternate channel, not the number the caller provided. Treat the helpdesk reset as a security incident, not a coaching moment. If vendor banking details were changed, assume fraud attempt and escalate to finance and legal.
2. Redesign the helpdesk identity-verification and MFA-reset process. What must change so this cannot repeat?
Read the worked answer
Remove the ability to reset MFA from a single inbound call. Require an out-of-band callback to a number already on file, not the caller-supplied number; for executives, require manager approval or a video check. Use a helpdesk-issued one-time code plus identity proofing, and log who approved what. Better, deploy self-service MFA reset with FortiAuthenticator or the identity provider after strong authentication. Restrict the reset role to a small group and review its audit trail. Test the process with a simulated vishing call. The control must make the CFO's assistant's knowledge of card digits and travel dates insufficient.
3. What detective and blast-radius controls would you add after containment?
Read the worked answer
Add conditional access that blocks impossible travel and requires compliant devices for VPN and mail. Enable outbound DLP and mail-flow rules that flag or hold messages containing bank-detail changes, especially from finance. Turn on MFA number matching and phishing-resistant FIDO2 for high-risk roles. Use FortiMail impersonation and display-name checks. Give vendors a verification protocol and tell them you will never change bank details by email alone. Monitor for new inbox rules and OAuth grants. Run a tabletop with helpdesk, finance, and legal. Measure time to revoke sessions and time to notify vendors; those are the blast-radius controls.