Rehearse the recovery order on your own account and time each step

short · 40 min · Objective 3.3

Task

Perform the account recovery sequence on one of your own accounts, in the correct order, and time it. Rehearsing it once means that on the day it matters the order is known rather than improvised, and the timing tells you what a real response would cost per account.

Steps

  1. Record the starting position in lab/recover/before.csv with header item,value covering active sessions, trusted devices, connected applications, mail rules, forwarding and recovery contacts.
  2. Change the password from a different device, then sign out all sessions, then verify the recovery contacts -- in that order, timing each. Record in lab/recover/sequence.csv with header step,order,minutes,what_it_stopped.
  3. Observe what happened on your other devices and record it in lab/recover/effects.txt -- specifically whether any session survived.
  4. Regenerate backup codes and review connected applications, recording the result in lab/recover/after.csv using the same header as before.csv.
  5. Write lab/recover/blast.md listing what this account could reset, found by searching the mailbox for registration and reset messages, and how many services that turned out to be.

Verify

awk -F, 'NR>1 && NF>=2 {n++} END {print n" starting item(s)"}' lab/recover/before.csv
awk -F, 'NR>1 && NF>=4 {n++} END {print n" sequence step(s)"}' lab/recover/sequence.csv
awk -F, 'NR>1 && $2==1 {print "first step: "$1}' lab/recover/sequence.csv
grep -c . lab/recover/effects.txt
awk -F, 'NR>1 && NF>=2 {n++} END {print n" ending item(s)"}' lab/recover/after.csv
grep -Ec '^[-*0-9]' lab/recover/blast.md

Six items either side, the sequence recorded with the password change first, and a blast radius list. The blast radius is usually much larger than the account's owner expects, which is the point of doing it on your own account first.

Notes

Searching the mailbox for "verify your email" and "reset your password" produces an inventory of everything registered to that address. It is a sobering exercise and there is no other way to produce a real list.

This is an independent study companion for CompTIA A+ Core 2 220-1202 and is not produced by or endorsed by CompTIA.