Is changing a stolen password enough? An infected computer can steal new passwords too. Check the device first.
⬇ Download PDF No sign-up, no contact details required. Need a print version? ↓
PDF · 10 pagesIdentify computers used with stolen passwords. Review their security alerts and malware scans.
→ Disconnect the suspicious computer. Have a specialist inspect it.
This is a first step, not a replacement for all the checks.
Select a check to see the instructions: what good looks like, how to check, the red flag and what to do.
The responsible person checks work email addresses, reviews alerts and records results.
Check work email addresses on Have I Been Pwned. Review alerts and identify affected accounts.
A stolen password was reported, but nobody checked the account.
Assign an owner. Enable available alerts and check affected accounts.
The administrator checked unfamiliar logins with employees and recorded recognised activity.
Review email and system login history. Ask employees about unfamiliar devices and times.
An employee does not recognise a successful account login.
Save suspicious login records. Investigate and restrict unauthorised access.
The employee stops using the computer until a specialist checks it.
Identify computers used with stolen passwords. Review their security alerts and malware scans.
Malware was detected, but the employee still uses the computer.
Disconnect the suspicious computer. Have a specialist inspect it.
The administrator ended unauthorised sessions and checked for recurrence.
Review active devices and sessions. Confirm unfamiliar entries with employees and check termination options.
An unauthorised device still accesses a business account.
End unauthorised sessions. Recheck login history to confirm access stopped.
The employee replaced reused passwords. The responsible person verified the changes.
Identify password reuse. Verify replacements and check for unfamiliar account recovery methods.
The stolen password still works on a business account.
Replace reused passwords from a trusted device. Remove unfamiliar recovery methods.
Employees need more than passwords to access company email and key systems.
Review email and system login settings. Verify extra login checks are required for everyone.
Company email requires only a password.
Enable extra login verification. Have every user test it.
Unfamiliar logins do not necessarily indicate hacking or data theft.
Use the document as the basis for your rules. Tick the checks for 30 working days until they become a habit.
The owner or manager decides which checks are mandatory and who owns them.
Who performs a check and who confirms it. Where possible, two different people.
Print the A4 sheet and keep it where the process happens.
Tick the checks daily, record exceptions and refine the rules when needed.
After 30 days you have an agreed rule, owners and a record of checks. Not a guarantee of security, a working practice.
We can independently test whether these controls work in practice, not only on paper.
Penetration testing specialist. Helps companies find vulnerabilities in web applications, APIs and infrastructure and decide which risks to fix first.
About Veiltrack → Questions about the security of your processes? Discuss your situation →
This guide contains general recommendations. The controls available to you depend on your company and the services you use.
