The Exposed Password

Part of the Stopping the Spread section of Coddy's Cybersecurity journey. Lesson 12 of 20.

Isolating a computer does not replace a password someone copied from it. The attacker may try that password from another computer.

The account protections from section 1 still matter. Reset an exposed password to replace the copied secret and sign out its sessions. Here is a separate practice account:

seclab reset ivo

You should see:

Password reset for ivo. Every session they had is signed out.

Inspect the account afterward:

seclab people ivo

Look for these lines:

ivo: Ivo Costa, Operations engineer
  mfa: on

MFA stays enabled. Even if MFA stopped the attempted sign-in, a reported password exposure still needs attention. Replacing the password also does not remove an unwanted process that is already running elsewhere.

Treat the account and computer as related parts of the incident, with different recovery actions.

Challenge

Easy

Ticket from Sam, IT lead

Maya reported entering her current password on a fake form. MFA stopped the sign-in, but the password is still exposed. Replace it while keeping MFA enabled. Keep west-laptop isolated and the company checkout working. Do not reset unrelated staff accounts.

Try it yourself

Terminal

All lessons in Stopping the Spread

1Trace the Connection

Follow a Connection Test a Route Follow the Whole Order Inside the Company Orders Without Payment

4Recover and Verify

Prove the Block Recover in Stages Report the Impact Review the Boundary Lumen Stays Open

2Close the Unwanted Route

Destination Rules Rule Order Outbound Rules Allow the Needed Work Two Unwanted Routes

3Contain More Than One Computer

Isolate a ComputerThe Exposed PasswordFollow the Spread Keep Customers Working Two Active Computers