Exactly which employees in your organization have the ability to alter recovery email settings?
How many of those employees are there?
In what fashion do you audit and track the activities of those employees?
What training are these employees given to avoid social engineering? What firm provides the courseware?
What's the escalation process for complicated, non-no-brainer reset situations? If a support person isn't absolutely sure whether they should reset something, how do they get a second opinion?
Are the support people who are entitled and able to make these changes incentivized to close tickets as quickly as possible?
Do you monitor "out-of-process" changes to recovery email and password settings, so that you can see trends over time and by particular staff members?
Has any third party security firm assessed your service recently specifically for this attack vector, for instance by conducting social engineering testing against your support staff? What's the firm?
How are you MINIMIZING, rather than just improving, the "human factors" involved in assessing whether accounts can be altered based on anonymous incoming callers and requesters?
This is a HUGE, TERRIFYING vulnerability. Email providers are the single most important security service people use; if your email is compromised, many (most!) of your other services are compromised as well.
How many of those employees are there?
In what fashion do you audit and track the activities of those employees?
What training are these employees given to avoid social engineering? What firm provides the courseware?
What's the escalation process for complicated, non-no-brainer reset situations? If a support person isn't absolutely sure whether they should reset something, how do they get a second opinion?
Are the support people who are entitled and able to make these changes incentivized to close tickets as quickly as possible?
Do you monitor "out-of-process" changes to recovery email and password settings, so that you can see trends over time and by particular staff members?
Has any third party security firm assessed your service recently specifically for this attack vector, for instance by conducting social engineering testing against your support staff? What's the firm?
How are you MINIMIZING, rather than just improving, the "human factors" involved in assessing whether accounts can be altered based on anonymous incoming callers and requesters?
This is a HUGE, TERRIFYING vulnerability. Email providers are the single most important security service people use; if your email is compromised, many (most!) of your other services are compromised as well.