A security operations center (SOC) detects an active compromise of an administrative account with elevated privileges across hybrid cloud infrastructure. To contain the incident and restore secure identity operations according to privileged access management (PAM) best practices, place the mitigation and lifecycle remediation steps in the correct chronological sequence.
- 1Terminate active administrative sessions and invalidate dynamic OAuth/OIDC tokens across the Identity Provider (IdP).
- 2Trigger an automated System for Cross-domain Identity Management (SCIM) force-sync to disable the compromised identity across federated SaaS applications.
- 3Rotate the credential baseline stored in the Privileged Access Management (PAM) vault for all affected service accounts.
- 4Conduct an Identity Governance and Administration (IGA) recertification audit to re-baseline entitlements and verify least privilege enforcement.
Cevap
The correct operational order for containing and remediating a compromised privileged account is: First, terminate active sessions and invalidate tokens at the IdP; second, trigger an automated SCIM push to revoke downstream federated SaaS access; third, rotate vaulted credentials within the PAM solution; fourth, perform an IGA entitlement recertification audit.
In security operations, incident containment prioritizes immediate threat suppression: active session termination and token invalidation at the IdP stop ongoing adversary actions. Once centralized sessions are severed, automated SCIM provisioning pushes account disablement to downstream federated services. Next, secrets stored in the PAM vault are rotated to prevent credential reuse. Finally, IGA recertification cleanses unauthorized entitlement changes made by the threat actor.
Adım Adım Çözüm
Anahtar Kavram
Identity Lifecycle and Incident Response Containment in IAM Operations