Send us the RFP Sign up free
Sign up free Send us the RFP
Back to course

P4 Shared Accounts and Offboarding

0% done: 0 of 6 lessons

Lesson 1 of 6 · Video

An inventory of every login

Progress is saved on this device only. Keep it across devices with a free LFW account.

Curriculum0 of 6 done
2 minutes 4 seconds. Captions are on. Narrated slides. The narration is a synthesized voice; a recorded voice replaces it later.

Find every account your institution's web presence depends on, from the domain registrar to the social media pages, and record who controls each one.

Notes

Step 1 of 7

Start here

A public institution's website is not one account. It is a chain: the domain registrar, the DNS service, the host, the website's administrator logins, the email newsletter, the forms service, the social media pages, the analytics, the video channel. Any link can be lost to a departed employee, a lapsed card or an attacker.

This course is for the person who owns the site: the clerk, the communications lead or the IT generalist who holds the keys. It starts with knowing what keys exist.

Step 2 of 7

Why start with an inventory

You cannot protect, recover or hand over an account you do not know about. CISA's Cross-Sector Cybersecurity Performance Goals (CPG 2.0) put it first among the identification goals: maintain a regularly updated inventory of all organizational assets. For a small institution's web presence, the assets are mostly accounts.

Step 3 of 7

What to look for

Work through these categories. Most institutions have something in each.

The address

  • domain registrar (where the domain is registered and renewed),
  • DNS service (sometimes the registrar, sometimes another service),
  • the .gov registrar, get.gov, if you have a .gov domain.

The website

  • hosting account or control panel,
  • website administrator logins (WordPress, Drupal or another system),
  • security services, such as a firewall or backup service,
  • licenses for paid plugins or themes.

What the website connects to

  • forms and payment services,
  • agenda and meeting software,
  • video and streaming (YouTube, a meeting platform),
  • maps, calendars and other embedded services,
  • analytics.

Your voice elsewhere

  • social media pages and accounts,
  • email newsletter service,
  • the opt-in emergency alert service, if your institution sends through it,
  • business listings, such as Google Business Profile.

Step 4 of 7

How to find the ones nobody remembers

  • Billing: go through a year of card statements and invoices. Every paid service is there.
  • Email: search shared and former employees' mailboxes, if policy allows, for "renewal," "invoice," "verify your email," "welcome to" and "password reset."
  • DNS records: your DNS settings list services that send email for you or verified your domain. Your web provider can read them with you.
  • Ask: every department head, the front desk and any vendor that has worked on the site.

Step 5 of 7

What to record for each account

  • the service and what it controls,
  • the sign-in address (the web page where you log in),
  • the login email and the recovery email and phone,
  • every named person who can get in, and their role,
  • whether two-step sign-in is on, and what method,
  • the owner responsible for it,
  • the vendor or contract, if any,
  • renewal date and cost, for paid services.

Do not write passwords in the inventory. They belong in the password manager.

Step 6 of 7

Where the inventory lives

The inventory is a map of everything worth attacking. Keep it in the institution's password manager, or a document with access limited to the people responsible. Never on a public shared drive, and never attached to an email.

Two people should be able to open it: you and a named backup. Lesson 6 covers keeping it current.

Step 7 of 7

What you will find

Expect surprises: an account in a former employee's name, a recovery email at a personal Gmail, a service nobody uses that still charges a card, two-step sign-in tied to the phone of someone who left. Do not fix them all today. Mark each one, and the next lessons cover what to do.

Sources

Transcript

Synthesized narration; a recorded voice replaces it later.

  1. 0:00A public institution's website is not one account.
  2. 0:03It is a chain: the domain registrar, the DNS service, the host, the administrator logins, the newsletter, the forms, the social media pages.
  3. 0:13Any link can be lost to a departed employee, a lapsed card or an attacker.
  4. 0:18You cannot protect, recover or hand over an account you do not know about.
  5. 0:23CISA's Cybersecurity Performance Goals put it first among the identification goals: a regularly updated inventory of all organizational assets.
  6. 0:32Work through four categories.
  7. 0:34The address: the registrar, the DNS service, and get.gov if you have a .gov domain.
  8. 0:40The website: hosting, administrator logins, security services and paid licenses.
  9. 0:47Then what the website connects to: forms and payments, agenda software, video, maps and analytics.
  10. 0:54And your voice elsewhere: social media, the email newsletter, the alert service, and business listings.
  11. 1:02To find the ones nobody remembers: go through a year of card statements and invoices.
  12. 1:07Search mailboxes, if policy allows, for renewal, invoice and password reset.
  13. 1:12Read your DNS records with your web provider.
  14. 1:15And ask every department head.
  15. 1:18For each account, record what it controls, the sign-in address, the login and recovery details, every person who can get in, two-step sign-in, the owner, the vendor, and the renewal date and cost.
  16. 1:30Do not write passwords in the inventory.
  17. 1:34The inventory is a map of everything worth attacking.
  18. 1:37Keep it in the password manager, or a document with limited access.
  19. 1:41Never on a public shared drive, and never attached to an email.
  20. 1:45Two people should be able to open it.
  21. 1:48Your task.
  22. 1:49Create the inventory with these columns.
  23. 1:51Fill in the address and website first.
  24. 1:54Go through a year of billing and add every web service you find.
  25. 1:57Mark every account with one person, a personal recovery email, or no two-step sign-in.

Task

Your task at your institution

Quiz

4 questions. Choose one answer for each, then check them. Each answer shows its reason.

1. Why does the domain registrar account matter so much?
2. Where is a good place to find accounts nobody remembers?
3. Where should the finished inventory be kept?
4. Which CISA Cybersecurity Performance Goal does an account inventory support?
Show the answers
  1. B. Whoever controls it controls the address of your website, and usually your email. The domain points to the website and the email service. Lose the registrar account and you can lose both.
  2. A. Billing records and card statements, plus a search of old email for renewal notices. Paid services leave a bill, and most services email renewals and verification messages.
  3. B. In the password manager or another access-controlled place. The list is a map of everything worth attacking. Only the people responsible should see it.
  4. A. Manage organizational assets. CISA's CPG 2.0 calls for maintaining a regularly updated inventory of organizational assets.