Who can disable a compromised account? Decisions to make before an incident

Where does delay enter the response?

A security analyst identifies suspicious activity on an account used by an important application. Disabling it may contain the threat, but could also stop customer transactions. The analyst escalates to a manager who is unavailable. Nobody knows whether the deputy can approve the action.

This illustrative situation is a governance problem with technical consequences. More alerts will not resolve it. The organisation needs a decision path that balances containment, service impact and the uncertainty of the evidence.

Which permissions should be separated?

Distinguish access to investigate from authority to change production. A team may be authorised to read logs without being authorised to disable every account. Define the additional conditions for containment, including scope, available evidence and escalation.

Specify a named role and a deputy rather than one person’s phone number. Establish controlled emergency access where appropriate and record its use. NIST’s incident-response guidance places preparation and response within wider risk management; these decisions should be part of normal governance.

How do we choose a proportionate action?

Give responders options appropriate to the environment. Depending on the facts and technology, these may include revoking sessions, restricting a particular privilege or isolating an affected endpoint. The runbook should identify who selects and authorises the option, not prescribe one action for every alert.

Account for shared services and automated accounts. Before a crisis, record dependencies and a recovery path. During the incident, document what was known, the decision, the responsible role and the time. Update that record as evidence changes.

How do we know the plan is usable?

Run a tabletop exercise with an unavailable primary approver and incomplete information. Ask the deputy to explain the next action, business impact and notification route. Capture the point where the plan becomes ambiguous and revise it.

Restoration also needs an owner. “The account is enabled again” does not establish that access is safe or the investigation is complete. Agree the checks and business acceptance required for return to service. Keep regulatory reporting clocks in the relevant reporting plan; this decision card does not replace them.

Explore in detail: The first 24 hours: the incident clock.