Whether to isolate a plant or keep production running from over-privileged

SITUATION A help-desk reset that bypassed step-up authentication put over-privileged service account in production in front of third-party risk analyst in a city government after a help-desk MFA fatigue wave. This Cybersecurity / Incident Response close is to isolate a plant from over-privileged service account in production, and the live options are To isolate a plant, Keep production running.

DECISION Third-party risk analyst in a city government after a help-desk MFA fatigue wave must choose To isolate a plant / Keep production running using over-privileged service account in production after a help-desk reset that bypassed step-up authentication.

HYPOTHESES TO TEST 1. Third-party risk analyst can defend To isolate a plant from over-privileged service account in production after a help-desk reset that bypassed step-up authentication in a Cybersecurity challenge. 2. Third-party risk analyst cannot defend To isolate a plant from over-privileged service account in production; Keep production running is what the extract actually supports after a help-desk reset that bypassed step-up authentication. 3. A help-desk reset that bypassed step-up authentication never reached the population in over-privileged service account in production — reopen intake, do not close to isolate a plant. 4. Two facts in over-privileged service account in production after a help-desk reset that bypassed step-up authentication conflict for third-party risk analyst; hold this Incident Response file.

ANALYSIS REQUIRED 1. Check SIEM or identity logs in over-privileged service account in production for reuse after a help-desk reset that bypassed step-up authentication. 2. Separate a scoped exception from an unbounded exposure a city government after a help-desk MFA fatigue wave has not measured. 3. Map identities, standing privileges, and last-use timestamps in over-privileged service account in production to the blast radius of a help-desk reset that bypassed step-up authentication. 4. For this Cybersecurity Incident Response file, read over-privileged service account in production against a help-desk reset that bypassed step-up authentication and write the one fact that would move to isolate a plant for third-party risk analyst.

RECOMMENDATION Choose To isolate a plant / Keep production running on this Cybersecurity / Incident Response packet (over-privileged service account in production after a help-desk reset that bypassed step-up authentication). If over-privileged service account in production cannot force a Cybersecurity label under Incident Response, stop. Do not invent missing evidence a city government after a help-desk MFA fatigue wave does not have.