What access may remain after a password reset?¶
A password reset may be an important containment step, but it does not always remove every route of access.
Avoid the dangerous assumption¶
The dangerous assumption is that changing the password automatically ends the incident.
Access may remain through:
- active sessions
- refresh tokens
- application permissions
- API keys
- trusted devices
- mailbox forwarding rules
- recovery methods
- new administrator accounts
- remote-access software
- compromised endpoints
- service-account credentials.
The exact behaviour depends on the provider, service and containment actions taken.
Investigators should preserve the state before and after the reset where possible.
Record:
- when the password changed
- who initiated the change
- which sessions were active
- whether sessions or tokens were revoked
- whether multi-factor settings changed
- whether applications retained consent
- whether forwarding or delegation existed
- whether recovery details were altered
- whether suspicious activity continued.
Do not assume continuing activity proves the reset failed. An automated process, shared account or separate persistence route may be involved.
Likewise, the absence of further activity does not prove every route was removed.
Current provider documentation or specialist support may be required to understand token lifetime, session invalidation and application consent.
Containment should consider the wider account environment, not only the password.
The same compromised device may immediately expose the new password or session.
For evidential purposes, the reset event can help define the response timeline and test whether activity continued afterwards.
Check connected accounts and delegated access as well. A compromised mailbox, administrator role or recovery account may allow the offender to regain access even where the original account appears secured.
Operational takeaway¶
Treat password reset as one containment action, and check sessions, tokens, applications, recovery routes, devices and account rules for continuing access.