Lesson 5 of 6
Lesson 5 — Verifying Identity and Staying Secure
Password resets, MFA, social engineering of the help desk, and least privilege.
Learn it
The service desk holds the keys: it can reset passwords, add access and take remote control. That makes it a target.
Always verify identity before any account action, using a method the caller cannot fake from public information.
Attackers use urgency and authority: 'I'm the head teacher, I'm about to present, just reset it now.' Urgency is the warning sign.
Never ask for, or accept, a user's password. Reset it and require a change at next sign-in.
Key terms
- Verification
- Proving the caller is who they claim before acting.
- Social engineering
- Manipulating a person to bypass technical controls.
- MFA
- Multi-factor authentication — something you know plus something you have.
- Least privilege
- Only the access needed, for only as long as needed.
- Callback verification
- Ringing back the number held in the official directory.
Four red flags in one call
'Hi, this is Dan from finance, new starter, my manager said you'd sort it.'
- 1Urgency: 'I'm in a meeting in two minutes' — pressure to skip checks.
- 2Authority: Name-drops a senior manager who cannot be reached.
- 3Unverifiable detail: Offers only information found on the public website.
- 4Scope creep: Asks for the password reset and to add themselves to the payroll group.
A safe reset procedure
text1. Confirm caller against directory: full name, employee ID, line manager.
2. Call back on the number stored in the directory (never one they give you).
3. Reset to a one-time password; force change at next sign-in.
4. Do NOT read the new password over voicemail or email it in plain text.
5. Log: who was verified, how, by whom, at what time.
6. If the request also asks for extra access -> STOP. That needs manager approval.Verification, one-time credential, separate approval for access changes, and a written trail.
Try it
Safe or unsafe help desk behaviour?
Asking the user to tell you their current password so you can test it.
Calling back on the number stored in the staff directory.
Resetting an account because the caller sounded senior and was in a rush.
Forcing a password change at next sign-in after a reset.
Challenge
Design a five-step identity verification script your desk will use for password resets, including exactly what you do if the caller fails a step and what you log.
Pick whichever way suits you — every mode earns the same bonus XP.
Write at least 40 more characters to submit.
Mark your own work
Guided walkthrough — 0/3 clues revealed
- Clue 1 locked — reveal it only if you get stuck.
- Clue 2 locked — reveal it only if you get stuck.
- Clue 3 locked — reveal it only if you get stuck.
Each clue costs 4 XP (never below 20 XP). You'd earn 40 XP right now.