iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A stolen employee or administrator credential should trigger an incident investigation, not just a password change. Your plan should identify the account and its reach, preserve logs and other evidence, contain active access, remove persistence, recover in controlled stages, and document improvements.
Build the plan before an incident around six phases: preparation; detection and analysis; containment; eradication; recovery; and post-incident review. Assign decision-makers, maintain centralized identity and system logs, define account and device isolation procedures, and require stronger authentication and monitoring after recovery.
What a stolen-credential incident includes
Credential theft can involve a password, session token, API key, recovery method, privileged account, or another authenticator. The first question is not simply whether the employee can still sign in. It is which identity was exposed, when it may have been used, what services and data it could reach, whether its privileges changed, and whether an attacker created another way to return.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
CISA’s 2024 Federal Government Cybersecurity Incident and Vulnerability Response Playbooks includes credential access and compromised administrator accounts among incident examples. Those playbooks are designed for Federal Civilian Executive Branch agencies and certain serious incidents, but CISA says the broader response practices are useful to public and private organizations. Adapt the actions to your identity provider, contracts, regulatory duties, and operational risk.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
CISA wrote in a 2018 alert that “Compromised account credentials continue to be the number one way threat actors are able to penetrate a network environment.” That is an attributed statement from a 2018 alert, not a current measured statistic. It does, however, explain why an apparently small account alert deserves a structured scope assessment.
Decide how serious the exposure may be
Use the account’s actual reach and the quality of your evidence to set the response level. Do not label an event harmless merely because no data loss is yet confirmed; absence of logs can mean absence of visibility.
| Assessment factor | Questions to answer | Response implication |
|---|---|---|
| Privilege | Was the identity a standard user, help-desk operator, developer, service account, domain administrator, or cloud administrator? | Privileged identities justify faster isolation, broader hunting, and consideration of specialist support. |
| Reach | Which email, remote-access, cloud, SaaS, endpoint, network, and business systems could it access? | Contact each system owner and include connected identities and delegated permissions in the scope. |
| Time window | When was the suspicious sign-in, phishing report, password exposure, or device compromise first observed? | Set an investigation window that starts before the first alert and ends after containment is verified. |
| Evidence quality | Are identity, application, endpoint, administrator, and network logs available and protected? | Limited evidence increases uncertainty and may require broader containment while facts are established. |
| Business impact | Could the account alter payments, production systems, safety functions, regulated data, or customer access? | Include legal, communications, continuity, and executive decision-makers early. |
Prepare the organization before credentials are stolen
Assign roles and authority
Name an incident lead and at least one backup. Give the lead written authority, or a clearly documented escalation path, to disable accounts, revoke access, isolate devices, preserve evidence, and engage outside assistance. CISA recommends a crisis-response team that spans technology, communications, legal, and business continuity.
| Role | Responsibilities to define in advance |
|---|---|
| Incident lead | Declares the incident, sets priorities, maintains the timeline, approves containment and recovery gates, and records uncertainty. |
| Identity administrator | Disables or restricts the identity, handles password and authenticator changes, reviews sign-in risk, and verifies session or token controls according to the identity platform’s current procedures. |
| System and network owners | Isolate affected endpoints or servers, preserve local artifacts, check privileged changes, and report operational consequences. |
| Security analyst or investigator | Collects and correlates identity, email, application, endpoint, network, and administrator events. |
| Legal and privacy adviser | Assesses contractual, regulatory, employment, insurance, and notification duties. |
| Communications lead | Prepares internal, customer, partner, and public messages through approved channels. |
| Business-continuity owner | Plans safe alternatives if disabling an account or isolating a system interrupts essential work. |
Record names, backups, phone numbers, secure out-of-band contact methods, and the authority each role holds. Do not rely on the potentially compromised email account or collaboration tenant as the only emergency channel.
Inventory identities, trust relationships, and owners
Maintain a current list of the identity provider, email service, remote-access gateway, cloud consoles, source-code and CI systems, endpoint-management platform, network devices, business applications, backup systems, and data owners. For each system, document who can disable access, how to preserve logs, how to contact support, and what a safe isolation action looks like.
Include delegated mailboxes, group memberships, service accounts, automation keys, OAuth grants, application passwords, recovery addresses, and administrator roles. A stolen user password may expose these connected paths even if the user never used them directly.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Make logs useful and defensible
CISA’s small-business logging guidance emphasizes user activity, administrator actions, network traffic, application logins, and system events. Before an incident:
- Enable the most useful audit events your systems support, including successful and failed sign-ins, privilege changes, authentication-method changes, account creation, mailbox rules, remote access, and administrative actions.
- Centralize logs where feasible so an intruder cannot erase every copy from the affected device or service.
- Restrict who can read, export, change, or delete logs; protect the logging service with separate administrative controls.
- Set retention periods that cover your normal investigation and contractual or regulatory needs.
- Create alerts for unusual locations or devices, repeated failures, impossible travel where supported, new MFA methods, privilege escalation, suspicious forwarding rules, and changes to recovery settings.
- Test that alerts reach a staffed channel and that timestamps can be correlated across systems.
Write the runbook and communication plan
Use a one-page call tree and a longer operational runbook. Define who can declare an incident, which facts can be shared, where evidence is stored, how decisions are logged, and when executives or customers must be informed. Prepare a neutral employee notice that asks people not to delete messages, reboot devices unnecessarily, or contact a suspected attacker.
Detect and assess the report
Reports may come from a phishing submission, an identity-provider alert, an employee who entered a password on a fake page, a suspicious mailbox rule, an unfamiliar login, a password found in malware, or a third party. Preserve the original alert, message, screenshot, ticket, or report before changing the account.
- Open an incident record. Record the reporter, detection time and time zone, suspected identity, initial evidence, systems named in the alert, and the person who accepted ownership.
- Preserve volatile context. Export the alert and relevant sign-in details if your platform permits it. Note device, IP or network, location estimate, user agent, authentication method, and the event’s exact timestamp.
- Confirm the identity and its owners. Check whether the account is human, shared, privileged, delegated, or used by automation. Identify its manager and every system owner responsible for connected access.
- Set an initial time window. Start before the first suspicious event when practical. Record why the start and end times may change as evidence arrives.
- Estimate reach. List groups, roles, applications, mailboxes, endpoints, keys, tokens, and data the identity could access. Mark unknowns instead of guessing.
- Choose an initial response level. A standard user with one isolated phishing event may need focused containment; an administrator account, unexplained persistence, or lateral movement warrants broader isolation and escalation.
Keep the timeline factual. Separate observed events, analyst inferences, and unresolved questions. This prevents a preliminary assumption from becoming the official incident story.
Contain the account without destroying evidence
Stop active access through approved controls
Use the identity provider and service owners to suspend or restrict the account according to your runbook. Depending on the platform, actions may include disabling sign-in, removing high-risk group memberships, blocking remote access, revoking registered authenticators, and invalidating sessions or tokens. Session and token behavior differs by platform; verify the identity provider’s current documentation rather than assuming a password change terminates every session.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesCapture the relevant sign-in and audit records before making changes when doing so will not leave an active attacker in place. If immediate containment is necessary, record what was changed, by whom, and at what time so investigators can distinguish response activity from attacker activity.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Isolate devices and connected systems when justified
Ask whether the credential was entered on a potentially infected endpoint, used from an unmanaged device, or associated with a server or cloud workload. Isolate the device or system through the approved endpoint or network process when continued access presents a material risk. Coordinate with the owner so isolation does not erase memory, logs, or other evidence unnecessarily.
Check privileged and related access
Review administrator roles, group membership, delegated permissions, mailbox rules, forwarding, recovery methods, API keys, OAuth grants, and newly created accounts. Investigate related systems and identities where the compromised account had access or where logs show the same source, device, or behavior. CISA’s threat advisory recommends isolation and review of relevant logs, data, and artifacts; its federal playbook treats lateral movement and compromised administrator accounts as serious response scenarios.
Communicate the containment decision
Tell the account owner what has been disabled, how to contact the response team through a safe channel, and what evidence to preserve. Notify system owners of operational effects without distributing sensitive indicators more broadly than necessary. If the event affects customers, partners, or regulated data, route notices through legal and communications roles.
Free tools Windows power users keep installed
One-click scans. No signup required.
Investigate the access and remove persistence
Build a reliable event timeline
Collect identity-provider sign-ins, email events, application logins, endpoint telemetry, VPN or remote-access records, firewall and network events, administrator actions, and relevant cloud audit trails. Align time zones and account for clock drift. Look for the first suspicious access, successful use after a failed attempt, changes made after login, and activity that continued after the password was changed.
Protect exported logs and artifacts from alteration or deletion. Restrict access to the evidence repository, record collection times and collectors, and preserve the original files when possible. Your organization may have formal forensic or legal-hold requirements; follow them.
Answer the core investigation questions
- How was the credential obtained: phishing, malware, password reuse, exposed secret, social engineering, or an unknown method?
- Which authentication factors, sessions, tokens, keys, recovery channels, or application grants were available?
- Which resources were accessed successfully, and which attempts failed?
- Did the actor read, download, alter, delete, forward, or create data?
- Were privileges, MFA methods, recovery addresses, mailbox rules, or group memberships changed?
- Did the identity authenticate to other systems, create accounts, or use tools associated with lateral movement?
- Do other accounts, devices, or systems show the same indicators?
Mark each answer as confirmed, probable, possible, or unknown. An honest unknown is safer than an unsupported claim that the account was unused.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Eradicate the cause and persistence
Remove malicious mailbox rules, unauthorized accounts, rogue authenticators, access grants, scheduled tasks, malware, and exposed keys identified by the investigation. Patch or reconfigure the initial weakness, remove the phishing site or malicious application where possible, and review other identities exposed through the same device or reused secret.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →For significant compromise or suspected lateral movement, consider qualified external incident-response or digital-forensics support. CISA notes that specialist support can help ensure threat actors are eradicated and residual access does not remain. Engage help when internal staff lack the time, tooling, independence, or expertise to establish scope confidently.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Recover with explicit gates
Reset the credentials that the evidence supports
Reset the confirmed exposed password or secret through a trusted administrative path, not through a link in a suspicious message. Revoke or rotate affected keys, tokens, application passwords, and recovery methods. Require the user to enroll approved MFA again if its trust is uncertain.
Do not turn a context-specific directive into a universal rule to reset every password. CISA has directed credential resets in specific federal incidents and discusses wider account and key resets in the context of Windows Active Directory compromise. The correct scope depends on what was compromised, the account’s trust relationships, the investigation, and your organization’s risk decision.
Use a recovery release gate
Restore normal access only when the incident lead and relevant owners agree that the known exposure has been addressed, required resets and removals are complete, essential evidence is preserved, and monitoring is ready. This is an organization-defined gate; the reviewed CISA material does not prescribe one universal technical release test.
For the first period after restoration, increase alert review for the affected identity, related administrators, connected applications, and indicators found during the investigation. Keep the incident record open until the monitoring owner confirms that the agreed observation period has ended or a new decision is documented.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Strengthen authentication after the incident
Prioritize phishing-resistant MFA
CISA says MFA makes access harder even when a password is compromised and recommends phishing-resistant MFA in its credential guidance. It identifies physical security keys as a preferred option. A key is a preventive control for future authentication; it does not contain or repair an incident that already occurred.
Choose an authenticator that works with your identity provider, browsers, operating systems, mobile devices, privileged workflows, and offline recovery process. Document spare-key custody, replacement, loss reporting, enrollment approval, and emergency recovery. A technically strong factor can still fail operationally if staff cannot enroll it or administrators cannot recover an account safely.
Improve password and secret management
CISA recommends an organization-wide password manager to help staff follow password practices. Select a service and policy that support centralized administration, unique generated passwords, secure sharing for approved business use, offboarding, auditability, and recovery. A password manager reduces reuse; it is not a substitute for incident logging, access reviews, MFA, or response authority.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Reduce privilege and standing access
Review whether the affected identity had more access than its job required. Separate everyday and administrative accounts, remove stale group memberships, shorten privileged access windows where your systems support it, and require stronger authentication for administrators. Record an owner and review date for every service account, API key, and delegated permission.
Complete the post-incident review
After containment and recovery, hold a review while evidence and decisions are still fresh. Document:
- The detection source, complete timeline, and changes to the time window.
- Accounts, systems, data, privileges, and third parties in scope.
- Observed attacker actions, confirmed impact, and remaining uncertainty.
- Containment, evidence-preservation, eradication, reset, notification, and recovery decisions, including who approved them.
- What logging, alerting, identity, endpoint, training, vendor, or continuity control failed or was missing.
- Specific owners and due dates for corrective actions.
Test the revised plan with a tabletop exercise. Walk through a standard employee account, a privileged administrator account, and an account whose endpoint is unavailable. Check whether the call tree works, logs can be exported, emergency authority is clear, and the organization can operate while access is disabled.
A practical response checklist
Before any incident
- Name the incident lead, backups, system owners, legal contact, communications lead, and continuity owner.
- Document authority to disable accounts, revoke access, isolate devices, preserve evidence, and hire specialists.
- Inventory identity, email, remote access, cloud, endpoint, network, backup, and business systems.
- Enable, centralize, protect, and retain user, administrator, network, application, and system logs.
- Test high-risk alerts and an out-of-band communication channel.
- Require MFA, prioritize phishing-resistant methods for high-risk accounts, and maintain recovery procedures.
When a credential is suspected stolen
- Open the incident record and preserve the original report and alert.
- Identify the account, privilege, systems, owners, and likely time window.
- Contain active access through approved identity and service controls.
- Isolate a device or system when evidence and risk justify it.
- Collect and protect identity, email, application, endpoint, network, and administrator artifacts.
- Hunt for privilege changes, persistence, related accounts, and lateral movement.
- Reset confirmed exposed credentials and rotate affected keys, tokens, and recovery methods.
- Restore access only through the documented recovery gate and monitor for recurrence.
After recovery
- Complete the timeline, scope, impact, decisions, and uncertainty record.
- Assign corrective actions for logging, privilege, MFA, password management, endpoint security, and communication gaps.
- Run a tabletop exercise and update the plan from what it reveals.
When to escalate beyond the internal team
Bring in external incident-response or digital-forensics specialists when a privileged account is involved, lateral movement is suspected, logs are incomplete or contested, malware may be present, regulated or high-value data may have been accessed, the attacker remains active, or the organization cannot investigate without compromising normal operations. Decide in advance how specialists will receive authority, evidence, secure access, and legal direction. External help supports the plan; it does not replace named internal decision-makers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
