Blog, FastPassCorp IVM Blog
How should IT help desks securely verify the identity of users who are calling for password reset assistance? | FastPass
How should IT help desks securely verify the identity of users who are calling for password reset assistance?
This article was originally published by LOGON’s partner FassPassCorp. Click here to view the original article.
IT help desks should use a variety of methods to securely verify the identity of users who are calling for password reset assistance, including:
Asking for identifying information: Name, date of birth, and other personal details to confirm identity.
Security questions: User-specific questions, carefully chosen to avoid easy guessing.
Verifying known equipment: Checking if the user is on their regular workstation or mobile PC.
Questions related to user behavior: Geo-location, log-in history, printer usage, etc.
Sending time-limited verification codes via email or text message.
Implementing two-factor authentication for an additional layer of security.
Using caller ID spoofing detection tools to prevent identity fraud.
Using a point-based score for verification, allowing users to pass multiple tests to be verified.
Trustworthy 3rd person verification or document proof for non-standard verifications.
Compliant identification process, with detailed workflows and auditing.
Ensuring user privacy and compliance with relevant laws and regulations.
Organizations prescribing user verification for IT security include:
National Institute of Standards and Technology (NIST): Provides technical standards and guidelines, such as "Digital Identity Guidelines" and "Multi-Factor Authentication and Identity Assurance."
International Organization for Standardization (ISO): Publishes standards like ISO/IEC 27001 for information security management systems.
Payment Card Industry Data Security Standard (PCI DSS): Sets security standards for organizations handling credit card information.
Cybersecurity and Infrastructure Security Agency (CISA): Works to protect critical infrastructure and offers guidance on user verification processes.
Please note that there might be more organizations with specific standards depending on the industry and regulatory environment.
Stop social engineering against your service desk
Workflow for secure verification of employees phoning in to get a service, like a new password, personal information, payment transaction, etc.
Get a Free Demo
Book a demo with our specialist to discover how IVM stops social engineering attacks against your service desk
Read Next:
