RB-RECOVERY-003: User Recovery & Access Restoration
Document Control
| Attribute | Value | Date |
|---|---|---|
| Document Name | User Recovery & Access Restoration | |
| Version | [Enter version number] | [Enter date] |
| Owner | [Enter owner/team] | [Enter date] |
| Status | [Draft/Approved/Retired] | [Enter date] |
| Next Review Date | [Enter next review date] | [Enter date] |
| Approvals | [Enter approver(s)] | [Enter date] |
| Change Summary | Initial creation | [Enter date] |
1. Prerequisites
- Containment confirmation (all sessions, tokens, and credentials addressed)
- Session revocation status
- MFA reset status
- Identity integrity assessment findings
- Access to identity provider
- Access to MFA platform
- Access to endpoint management platform
- Access to SIEM
- Access to service desk tooling
2. Step-by-Step Instructions
-
Validate Containment Completion
- Confirm sessions revoked
- Confirm tokens invalidated
- Confirm OAuth abuse addressed
- Confirm rogue devices removed
- Confirm credentials reset
-
Reset Credentials Securely
- Require strong password creation
- Require MFA enforcement
- Require identity verification
- Require password reuse prevention
-
Re-Enroll MFA
- Validate trusted MFA methods
- Validate approved devices
- Validate recovery methods
- Validate conditional access enforcement
-
Restore User Access
- Re-enable identity provider access
- Re-enable SaaS access
- Re-enable VPN access
- Re-enable email access
- Re-enable administrative access (if applicable)
3. Post-Action
- Record the credential/MFA reset method, the type of access restored, and a timestamped log of all actions within the incident ticket.
Contributor
Vishal Thakur GitHub: https://github.com/malienist
Jayden Vo GitHub: https://github.com/jayden-vo
Contributed to the Arcana Incident Response Documentation Framework.