Audit one account's persistence surface and time how long it takes

short · 35 min · Objective 2.2

Task

Take one of your own accounts through the full post-incident audit -- sessions, tokens, grants, rules, forwarding, recovery details, trusted devices -- and time it. The timing is part of the exercise: knowing that it takes ten minutes per account is what makes it possible to plan a real response.

Steps

  1. Write lab/persist/surface.csv with header surface,where_to_find_it,what_you_found,action_taken covering active sessions, trusted devices, connected applications and OAuth grants, application passwords, mail rules, forwarding, delegation, recovery email, recovery phone and backup codes.
  2. Record how long the whole audit took in lab/persist/timing.txt, along with which surface was hardest to find.
  3. Write lab/persist/survives.md listing which of those surfaces survive a password change, and which survive signing out all sessions.
  4. Write lab/persist/order.md giving the correct order for a real incident -- password, sessions, recovery, audit -- with one sentence on why each comes where it does.
  5. Record your sign-in history in lab/persist/history.txt: how far back it goes, what it shows, and whether anything is unrecognised.

Verify

awk -F, 'NR>1 && NF>=4 {n++} END {print n" surface(s) audited"}' lab/persist/surface.csv
awk -F, 'NR>1 && $3!="" {n++} END {print n" surface(s) with a finding"}' lab/persist/surface.csv
grep -Ec '^[-*0-9]' lab/persist/survives.md
grep -Eic 'session|grant|forward' lab/persist/survives.md
grep -c . lab/persist/timing.txt
grep -c . lab/persist/history.txt

Eight or more surfaces audited, a timing recorded, and a survives list naming sessions, grants and forwarding. If every surface came back empty, record that -- a clean audit is a result, and knowing the shape of it is what makes an unclean one recognisable.

Notes

Connected applications is the surface people have never looked at, and it is the one that grants continuing access to mail and files without a password. Ten minutes here is the cheapest security work available to anyone.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.