Lion Cipher Lab
Interview scenario: "A caller says they lost their phone and need an MFA reset now" (measure your help-desk procedure)
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Multi-factor authentication (MFA: a second proof of identity on top of the password, such as a code on your phone) is only as strong as the way you get it back when you lose it. Attackers know this. Instead of breaking MFA, some crews simply phone the IT help desk, pretend to be an employee, and talk the agent into resetting the password or moving the MFA to a new device. CISA's joint advisory on the group tracked as Scattered Spider describes exactly that. So when an interviewer for an identity or security role says "the CFO is on the phone, lost their phone, needs a reset right now, walk me…
What you'll learn
- Recognizing help-desk impersonation (the social-engineering path to an MFA reset) as a real, documented attack technique
- Explaining why knowledge questions (employee ID, manager name, last 4 of a phone) do not verify identity
- Designing a layered MFA-reset procedure: callback on the number of record, identity proofing through a verified channel, out-of-band manager approval, notification on every channel, a time delay for privileged accounts, and a short-lived Temporary Access Pass
- Measuring a procedure before and after: attackers let through, legitimate users refused or held, and minutes added (the honest cost)
- Judgment under pressure: urgency as a warning sign, more scrutiny for executives, and when a documented break-glass path replaces the help desk
- Delivering a structured 60-second interview answer and a one-page help-desk procedure
Steps in this lab
- The prompt, and what the interviewer is really grading
- Why this exact call is a real attack, not a hypothetical
- Open a terminal and make a working folder
- Create the ten calls and decide each one yourself (naive rule)
- Score the naive procedure: count the attackers who got through
- Design the stronger procedure, one layer at a time
- Re-score and read the before and after, including the cost
- Which layer did the work? Switch layers off and re-score
- The honest negative: why T07 still got through, and what a pro adds
- The judgment calls: urgency, executives, and when to break the rule
- Deliver it: the 60-second answer and the one-page procedure
- Clean up