Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Assume the compromise is active until you can prove otherwise. Alert the incident-response lead, contain the account or system without wiping evidence, revoke every surviving session and token, determine which tickets and people were exposed, then fix the entry path and make fact-specific notification decisions with counsel. A password reset by itself is not a complete response.
1. Start a coordinated response immediately
A helpdesk breach can expose customer conversations, password-reset links, internal notes, attachments, and administrative functions. Treat the first hours as both a security emergency and an evidence-preservation exercise. Appoint one incident-response lead who can approve containment while keeping security, IT, legal, privacy, communications, and the support business owner aligned.
Activate the right people
- Assign an incident commander and an alternate.
- Bring in identity and endpoint administrators, the helpdesk owner, privacy and legal counsel, and communications.
- Notify the helpdesk provider and identity provider if their infrastructure, integrations, or logs could be involved.
- Open a controlled incident record. Log discovery time, decisions, approvals, people involved, and every system change.
The Federal Trade Commission (FTC) advises mobilizing a response team, securing systems, changing stolen credentials, checking provider access, and documenting the investigation. Do not let several teams make unrecorded changes independently; that can leave gaps in both containment and the timeline.
Contain the compromised identity or system
- Disable or restrict the suspected account when doing so will not create greater operational risk. If the account is needed for business continuity, remove privileged roles and limit sign-in locations while the response lead evaluates the risk.
- Change the compromised password and any other credentials that may have been reused elsewhere. Reset administrative, delegated, recovery, and service accounts connected to the identity.
- Invalidate the compromised authenticator. NIST Special Publication 800-63B says a compromised authenticator should be promptly suspended, invalidated, or destroyed.
- Terminate active browser and mobile sessions from the identity provider and the helpdesk application.
- Revoke access and refresh tokens, API keys, personal access tokens, OAuth grants, webhooks, and integration secrets wherever the platform supports it.
- Review administrator impersonation, delegated access, recovery email and phone numbers, newly enrolled authenticators, forwarding rules, and other persistence mechanisms.
Do not assume a password change ends access. NIST notes that access and refresh tokens can remain valid after an authentication session ends. Verify the result in the relevant consoles rather than relying on a confirmation message from one system.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Preserve evidence while you contain the threat
Containment and forensics must happen together. FTC guidance says not to destroy forensic evidence, and CISA highlights volatile data and logs with short retention periods. Ask the response lead or a qualified forensic specialist what must be captured before making destructive changes.
Capture records before they disappear
- Export identity-provider sign-in, authentication, MFA, and administrative audit logs.
- Preserve helpdesk audit trails showing ticket views, searches, exports, edits, deletions, impersonation, password resets, and configuration changes.
- Collect endpoint, email, VPN, firewall, proxy, DNS, cloud, and network telemetry relevant to the suspected access window.
- Save alerts, screenshots, notification emails, and samples of suspicious messages or files with their original timestamps.
- Record system time zones and the method used to export each log so investigators can build a reliable timeline.
If volatile evidence such as system memory or short-retention logs may identify the attacker, obtain specialist direction before shutting down, reimaging, or rebuilding a machine. If immediate risk requires isolation, document who approved it, when it happened, and what evidence was collected first.
Maintain an evidence record
Use a restricted case repository and record the source, collector, collection time, format, and storage location for each item. Keep original exports unchanged; perform analysis on copies. Limit access to investigators and counsel as appropriate, because the evidence may contain customer data or privileged communications.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Establish what happened and what was exposed
Do not announce a data exposure merely because an account was compromised. Determine what the intruder could access and what the logs show they actually did. Build a timeline from the first suspicious event through containment and recovery.
Answer the access questions
- What was the initial entry path: phishing, password reuse, stolen session token, malicious integration, vulnerable endpoint, or provider-side event?
- Which identities, roles, devices, IP addresses, applications, and service providers were involved?
- Which tickets, queues, attachments, exports, knowledge-base articles, and customer profiles were viewed, changed, downloaded, or deleted?
- Were password resets, authentication-code requests, payment changes, refunds, or account-email changes attempted?
- Did the intruder create users, enroll MFA, add API keys, alter routing rules, install integrations, or send messages from the support system?
- Are there signs of lateral movement into email, identity administration, CRM, billing, or internal networks?
Classify the information in affected tickets
Support records vary widely. Review representative tickets and attachments for passwords, reset links, one-time authentication codes, payment-card or bank information, government identifiers, health information, personal contact details, confidential contracts, or proprietary business material. Treat the presence of a sensitive field as a question to verify, not proof that every ticket contained it.
FTC guidance recommends reviewing preserved data and backups, examining logs to determine who had access, and verifying the types of information and number of people affected. Include contractors and service providers in that review. Ask each provider for its incident timeline, affected components, log coverage, containment actions, and evidence supporting its claims; do not accept a verbal assurance as the complete investigation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Use a scope table
| Scope item | Record | Why it matters |
|---|---|---|
| Accounts | User, administrator, service, delegated, and integration identities | Determines which credentials and privileges require rotation |
| Time window | Earliest credible access through final revocation | Defines the logs, tickets, and people to examine |
| Actions | Views, searches, exports, edits, deletions, messages, and configuration changes | Separates possible access from confirmed activity |
| Data | Categories of personal, financial, authentication, or confidential information | Drives risk analysis and notification decisions |
| People and locations | Customers, employees, contractors, and jurisdictions involved | Identifies applicable laws, contracts, and regulator instructions |
4. Remove the cause before restoring normal access
Recovery is not complete when the attacker is locked out. Fix the weakness that allowed the compromise and verify that the fix works.
Review identity and privilege controls
- Apply least privilege to agents, supervisors, administrators, vendors, and service accounts.
- Remove dormant users, shared accounts, unnecessary delegated access, and unused integrations.
- Require MFA for helpdesk, identity, email, VPN, and other critical accounts; enforce it rather than merely offering enrollment.
- Check MFA recovery, helpdesk-assisted reset, device replacement, and emergency bypass procedures for social-engineering weaknesses.
- Prefer phishing-resistant MFA for critical services where feasible. CISA identifies phishing-resistant MFA as a protection for services such as email, VPN, and accounts that reach critical systems.
- Separate support administration from ordinary agent work and segment the helpdesk from unrelated internal systems.
A FIDO2 security key is one possible phishing-resistant MFA implementation, but it is a hardening choice rather than a substitute for investigation. Confirm that the identity provider, recovery process, administrator deployment model, and helpdesk workflow support the authenticator before rollout.
Check the provider and integration chain
Inventory every connection that can read or write support data: CRM synchronization, email, chat, telephony, analytics, automation, web forms, data warehouses, and vendor support accounts. Rotate secrets, narrow scopes, and recreate integrations only after confirming the provider’s security and logging. Review contractual notification, audit, retention, and cooperation obligations at the same time.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Recover in controlled stages
- Keep affected accounts restricted until credential rotation, token revocation, and log review are complete.
- Restore from known-good configurations or backups only after checking that they do not contain the persistence mechanism.
- Test MFA, password-reset, delegation, API, and integration controls with a small administrator group.
- Monitor sign-ins, privilege changes, exports, and unusual ticket activity at heightened sensitivity.
- Expand access in stages, with an owner and rollback plan for each step.
5. Decide whether notification is required
Notification depends on the information involved, the people affected, their locations, your sector, contracts, and the governing law. There is no universal deadline or single recipient that applies to every helpdesk incident.
Map facts to obligations
- List the categories of information that were confirmed or reasonably suspected to be accessible.
- Identify the residence or location of affected individuals, your organization, and relevant service providers.
- Check state, territorial, national, sector-specific, contractual, and regulator requirements that apply to those facts.
- Ask counsel to determine whether notices go to individuals, regulators, law enforcement, payment networks, customers, partners, or other recipients.
- Track each applicable deadline and the information needed to meet it; revisit the assessment if the scope changes.
The FTC’s U.S.-oriented overview notes that all states, the District of Columbia, Puerto Rico, and the U.S. Virgin Islands have security-breach notification legislation, with possible additional federal or sector requirements. That overview does not establish one nationwide timing rule. Consult qualified counsel and the current instructions of the relevant regulators during the incident.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →If financial information or Social Security numbers were involved, ask counsel and the response team whether credit monitoring or identity-support services are appropriate. The FTC presents that as a consideration for some breaches, not an automatic remedy.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
6. Communicate without creating a second incident
Designate one communications point person and coordinate every external statement with legal, privacy, security, and the incident commander. Use plain language and distinguish confirmed facts from ongoing investigation.
Include useful information
- What happened and when the organization detected it.
- Which systems or account types were involved.
- What information may be involved, stated by category rather than speculation.
- What the organization has done to contain, investigate, and harden the environment.
- What affected people can do now, such as changing reused passwords, watching for targeted phishing, or contacting a dedicated support channel.
- How to obtain updates and report suspicious follow-up messages.
FTC guidance cautions against misleading people, withholding important protective information, or publishing details that could put consumers at further risk. Do not disclose attacker tactics, unverified victim lists, or technical details that would help continued abuse.
7. When to bring in outside incident-response help
Seek qualified digital-forensics or incident-response assistance when the attacker may still be present, privileged systems are involved, logs are incomplete, evidence could be challenged, or the organization lacks staff experienced in preserving and analyzing evidence. Choose a provider by capability rather than brand name.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Selection factor | Questions to ask |
|---|---|
| Relevant experience | Has the team handled identity, SaaS, helpdesk, and service-provider compromises? |
| Evidence capability | Can it collect volatile data, preserve chain of custody, and work with your logging systems? |
| Availability | What response time, staffing model, escalation path, and hours of coverage are contractually guaranteed? |
| Deliverables | Will you receive a timeline, affected-account list, indicators, root-cause analysis, and remediation plan? |
| Confidentiality | How are customer data, privileged material, subcontractors, and cross-border transfers handled? |
| Terms | Do the contract, retention rules, insurance, and cooperation clauses fit your incident and regulatory needs? |
8. Common mistakes that prolong a helpdesk breach
- Only changing the password: active sessions, refresh tokens, API keys, and delegated access may survive.
- Wiping first: reimaging or deleting logs can destroy the evidence needed to identify the scope and root cause.
- Assuming access equals exposure: logs and ticket review are needed to distinguish capability from confirmed activity.
- Ignoring the provider: a vendor, integration, or identity system may retain access after the visible helpdesk account is disabled.
- Making a legal promise too early: notification duties depend on facts and jurisdiction, and can change as the investigation develops.
- Sending vague customer messages: people need to know what may be involved and what protective steps are useful.
- Restoring everything at once: staged recovery and heightened monitoring make it easier to catch persistence or a second compromise.
9. Close the incident and prevent recurrence
After containment and notification decisions, complete a written post-incident review. Record the initial access path, control failures, evidence gaps, decisions, costs, affected data, provider performance, and the date each corrective action was verified. Update the incident-response plan with named owners and contact methods that work outside the compromised environment.
Within the next review cycle, test account-disablement, token revocation, MFA recovery, log export, provider escalation, customer communications, and backup restoration. Measure whether logs are retained long enough for investigation, whether privileged actions are visible, and whether support agents can recognize social-engineering attempts. Close an action only when an owner has demonstrated the control in a test or production-safe validation, not merely when a ticket is marked complete.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
