Multi-factor authentication (MFA), conditional access policies and other identity controls make it harder for attackers to gain unauthorized access. But these protections can be undermined if the process for recovering access isn't held to the same standard. When an employee needs to regain access to their account, it's often the service desk that provides the password reset or account recovery.
Yet identity verification commonly still relies on knowledge-based questions, such as an employee's manager's name or department. This creates a gap in identity security where a weaker route into an account can bypass stronger login security. And as social engineering attacks become more convincing, that gap is becoming increasingly dangerous.
Attackers can gather a surprising amount of information before making a call. LinkedIn profiles, company websites, social media and leaked data can reveal everything from job titles and colleagues to office locations and personal details. Armed with this information, an attacker can answer verification questions correctly and appear to be a legitimate employee.
