CRI Threat Mapper v12.0 -- Threat Advisory

2A. ATT&CK Techniques

Excluded: brute-force techniques (T1110) -- existing complexity (RG-7) and lockout (RG-8) controls mitigate; this gap concerns the device, not the credential I.

2B. D3FEND Countermeasures

• D3-MFA -- Multi-factor Authentication D: Reduces the value of a bare stolen password from unmanaged devices. URL: d3f:MultifactorAuthentication
• Certificate-based device authentication (Verify ID) I: Issuing device certificates (or equivalent conditional-access device compliance checks) extends the Kerberos-domain trust model to non-domain endpoints. D3FEND v1.4.0 taxonomy entry -- Verify ID before citing.
• D3-AI -- Asset Inventory D (Verify ID): A complete inventory of authorized devices is the precondition for enforcing device authorization.

2C. Control Type Gap

I Missing Preventive control (device authorization/posture gate for non-domain endpoints) and the supporting Detective control (visibility of which unmanaged devices are touching bank resources). Kerberos covers domain devices only; MDM's email-only scope means no corrective lever (quarantine/wipe) exists for non-email access paths. Why it matters: preventive device trust is the control that makes credential theft insufficient on its own.

2D. Regulatory Relevance and Examination Perspective

Regulatory Relevance D: Interagency Guidelines Establishing Information Security Standards, 12 CFR Part 364, Appendix B, III.C.1.a -- access controls on customer information systems (binding for FDIC-supervised state nonmember banks). FFIEC IT Examination Handbook, Information Security booklet (September 2016), Section II.C "Risk Mitigation" -- access and network control guidance addresses restricting access to authorized devices (subsection: Verify section number). FFIEC handbooks are examiner guidance, not binding regulation; the connection is that the booklet describes device authorization and remote-access controls the gap leaves unimplemented for non-domain endpoints.

Examination Perspective I: Unmanaged BYOD/contractor access paths to systems holding customer information commonly attract examiner attention during IT examinations, particularly where MDM scope is limited. No prediction of specific supervisory outcomes is made.

2E. KPIs

2F. Evidence of Closure

• I Updated remote-access/BYOD standard requiring device authorization for all endpoint classes, with approval date.
• I MDM or conditional-access enrollment report showing coverage beyond email (VPN, file, application access).
• I Sample of contractor onboarding tickets showing device registration/posture verification.

2G. SIEM Log Sources

2H. Detection Specifications

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 1.1 "Establish and Maintain Detailed Enterprise Asset Inventory" and Safeguard 1.2 "Address Unauthorized Assets" -- prerequisite and enforcement for device authorization.
• D CIS Controls v8.1, Safeguard 6.4 "Require MFA for Remote Network Access" -- compensates for absent device trust on remote paths.
• I Platform benchmark: CIS Microsoft Windows Server Benchmark (current version per platform) network-access sections apply to domain enforcement points; specific recommendation numbers -- Verify ID.

2K. Incident Scenario

I A contractor's personal laptop, already infected with an infostealer, connects to the bank VPN using valid contractor credentials. Because no device authorization or posture check exists outside domain join, the session is indistinguishable from a sanctioned one. The malware harvests the contractor's cached bank credentials and session tokens, and the attacker returns after hours from their own infrastructure using the same account. With MDM limited to email, no quarantine or wipe lever exists, and the intrusion is discovered only when the contractor reports unrelated fraud on the device.

2L. Compensating Controls Assessment

I Without: Medium-High exposure. With enforced MFA on all remote access (if RG-7/RG-8-adjacent MFA exists -- verify deployment): revised to Medium. Limitation: MFA authenticates the person, not the device -- it does not stop session-token theft or malware-resident access from a compromised unmanaged endpoint. With network segmentation restricting BYOD/contractor VLANs to limited destinations: revised to Medium-Low. Limitation: segmentation is only as good as the destination allow-list and does not cover VPN full-tunnel access.

2N. Data Classification Impact

I At risk via unmanaged devices: customer NPI and PII accessible through user sessions (email attachments beyond MDM control paths, file shares, browser-cached data), and authentication secrets (cached credentials, session tokens) on unmanaged endpoints. Financial records exposure is bounded by the user's application entitlements -- which RG-5's least-privilege gap widens.

2Q. Audit Test Procedures

• I Obtain the device inventory and reconcile against 30 days of VPN and 4624 authentication logs; investigate unmatched device identifiers. Evidence: reconciliation workpaper, exception listing.
• I Select a sample of contractor onboarding records; verify a device-authorization step was performed. Evidence: onboarding tickets, MDM/certificate enrollment records.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID against the institution's EEE evidence layer.

2A. ATT&CK Techniques

Excluded: discovery techniques (T1069 Permission Groups Discovery) -- the gap does not make discovery easier; AD group enumeration is available to attackers regardless of documentation state I.

2B. D3FEND Countermeasures

• D3-DAM -- Domain Account Monitoring D (Verify ID): Monitoring domain accounts against a documented baseline turns informal mappings into detectable deviations.
• D3-UAP -- User Account Permissions D (Verify ID): Formal role definitions enable systematic permission restriction per role.

2C. Control Type Gap

I This is primarily a missing Detective enabler: the preventive mechanism (AD groups) works, but without documented mappings there is no baseline for review (RG-6), monitoring (RG-12/13), or recertification to compare against. It is the documentation keystone on which three other RGs depend.

2D. Regulatory Relevance

Regulatory Relevance D: 12 CFR Part 364, Appendix B, III.C.1.a (access controls). FFIEC IT Examination Handbook, Information Security booklet (September 2016), Section II.C -- guidance describes defining access rights by role/job function as part of access-rights administration (subsection: Verify section number). Guidance, not binding regulation; the connection is that informal role definitions fall short of the described administration discipline.

Examination Perspective I: Examiners commonly test whether access rights administration is documented and repeatable; informal tribal-knowledge mappings tend to draw follow-up requests. No specific supervisory outcome is predicted.

2E. KPIs

2F. Evidence of Closure

• I Approved role catalog (role -> AD group -> entitlement) with owner and review date.
• I Reconciliation report of AD group memberships against the catalog, with dispositioned exceptions.

2G. SIEM Log Sources

2H. Detection Specifications

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 6.8 "Define and Maintain Role-Based Access Control" -- directly on point.
• D CIS Controls v8.1, Safeguard 5.1 "Establish and Maintain an Inventory of Accounts" -- supporting inventory discipline.

2K. Incident Scenario

I An attacker who has phished a helpdesk account quietly adds a controlled user to the "FIN-Wires" AD group. The SOC sees the group-change event but, with no documented mapping of which roles belong in which groups, the analyst cannot tell whether the change is routine and closes it. Weeks later the account is used to stage fraudulent wire templates. Post-incident review finds the change was visible on day one -- it was undetectable only because "correct" membership was never written down.

2L. Compensating Controls

I Without: Medium. With functional AD group hygiene plus quarterly IT-led membership eyeballing: revised to Medium-Low. Limitation: reviewers without documented role definitions substitute personal judgment, which drifts with staff turnover -- the informal knowledge this gap describes is itself the single point of failure.

2N. Data Classification Impact

I Indirect but broad: undocumented mappings make over-grants to NPI/financial-record groups (core banking, wire, loan systems) invisible. Highest-consequence data is whatever the least-well-documented critical group protects.

2Q. Audit Test Procedures

• I Request formal role definitions; if unavailable, document as designed-control absence. Evidence: policy/standard extract or absence memo.
• I Select 3 critical systems; have management articulate role-to-group mapping and compare to actual AD membership. Evidence: interview notes, AD group export, variance analysis.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

2B. D3FEND Countermeasures

• D3-UAP -- User Account Permissions D (Verify ID): Restricting permissions to job need is the direct countermeasure to creep.
• Job Function Access Pattern Analysis (Verify ID) I: Comparing actual access patterns to job function surfaces dormant excess entitlements for removal. D3FEND v1.4.0 user-behavior-analysis family -- Verify ID.

2C. Control Type Gap

I Missing Preventive control at grant time (business-purpose justification gate) and missing Corrective control at role change (proactive entitlement re-baseline). Detective coverage is also thin because RG-6 reviews are Symitar-only. Why it matters: least privilege is the control that caps consequence when any other identity control fails; its absence is a risk multiplier for every other gap in this statement.

2D. Regulatory Relevance

Regulatory Relevance D: 12 CFR Part 364, Appendix B, III.C.1.a (access controls consistent with the sensitivity of customer information). FFIEC IT Examination Handbook, Information Security booklet (September 2016), Section II.C -- the booklet's access-rights guidance describes granting access based on job need and least privilege (subsection: Verify section number). Guidance, not binding regulation; the gap is a direct shortfall against that described practice.

Examination Perspective I: Absent business-need justification for access grants is a finding pattern examiners commonly probe via user-access sampling. Appropriately hedged; no supervisory outcome predicted.

2E. KPIs

2F. Evidence of Closure

• I ServiceNow workflow screenshot/config showing mandatory business-justification field with approver.
• I Role-change procedure requiring entitlement re-baseline, plus samples of executed re-baselines.
• I Before/after entitlement reduction report for a pilot department.

2G-2Q. Remaining Analysis

2G. SIEM Log Sources

2H. Detection Specifications

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 6.1 "Establish an Access Granting Process" and 6.2 "Establish an Access Revoking Process".
• D CIS Controls v8.1, Safeguard 5.4 "Restrict Administrator Privileges to Dedicated Administrator Accounts".
• D CIS Controls v8.1, Safeguard 3.3 "Configure Data Access Control Lists".

2K. Incident Scenario

I A lending officer transfers to marketing; her loan-system and shared-drive entitlements are never removed because re-baselining is reactive. Eight months later her credentials are phished. The attacker, expecting marketing collateral, instead finds live access to loan files and the servicing share, exfiltrates borrower NPI, and uses retained server logon rights to move laterally toward the imaging system. The breach scope is defined not by her current job, but by every job she ever held.

2L. Compensating Controls

I Without: Medium-High. With Symitar annual review (RG-6 partial coverage): revised to Medium for core banking entitlements only. Limitation: the review is annual (long creep window) and Symitar-only -- network shares, lending, and ancillary systems retain unreviewed creep.

2N. Data Classification Impact

I Direct: customer NPI and financial records (loan files, account data, wire templates) -- creep concentrates multi-department data access in single accounts. PII of employees (HR shares) similarly exposed.

2Q. Audit Test Procedures

• I Sample 25 access grants from the last 12 months; test for documented business justification and approver. Evidence: ServiceNow tickets, exception rate.
• I Select 10 employees with role changes in the last 18 months; compare current entitlements to current role requirements. Evidence: HR change records, entitlement reports, creep findings.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

2B-2Q. Full Analysis

2B. D3FEND Countermeasures

• D3-DAM -- Domain Account Monitoring D (Verify ID): Continuous account monitoring approximates, between review cycles, what owner recertification does periodically.
• D3-LAM -- Local Account Monitoring D (Verify ID): Directly addresses unreviewed local accounts on ancillary systems.

2C. Control Type Gap

I Missing Detective control (periodic owner recertification) and its Corrective follow-through (revocation of access the owner does not recertify). IT's ad hoc review is a weaker substitute because IT lacks business context to judge whether access is still needed.

2D. Regulatory Relevance

D 12 CFR Part 364, Appendix B, III.C.1.a and III.C.3. FFIEC Information Security booklet (September 2016), Section II.C -- periodic review of access rights by management/system owners. I User-access review evidence is among the most commonly requested examination artifacts.

2E. KPIs

2F. Evidence of Closure

• I Access-review standard assigning owner responsibility, with system-to-owner matrix.
• I Completed recertification packages for at least two non-Symitar critical systems, with owner sign-off and revocation actions.

2G. SIEM Log Sources

2H. Detection Specifications

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 5.1 "Establish and Maintain an Inventory of Accounts" and 5.3 "Disable Dormant Accounts".
• D CIS Controls v8.1, Safeguard 6.1/6.2 (granting/revoking processes).

2K. Incident Scenario

I During a systems migration two years ago, IT granted a vendor engineer accounts on the loan-imaging and reporting servers. The project ended; the accounts did not. Because neither system has an assigned owner or review cycle, no one ever reconfirms the account list. When the vendor suffers a breach, attackers replay the engineer's reused password against the bank's externally reachable reporting portal and land on a fully privileged, long-forgotten account.

2L. Compensating Controls

I Without: Medium-High. With Symitar annual review: revised to Medium for the core system only. With ad hoc IT review: marginal improvement -- undocumented cadence and no business context.

2N. Data Classification Impact

I Non-Symitar systems typically hold customer NPI and financial records in secondary forms (imaging, reporting, loan origination), plus employee PII.

2Q. Audit Test Procedures

• I Obtain the system inventory; test for named asset owners and review schedules per system.
• I For two non-Symitar critical systems, obtain the full user list and ask the business unit to identify each user's need; quantify unrecognized access.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

Excluded: T1110.001/.002 (guessing/cracking) -- RG-7 complexity and RG-8 lockout are rated Full and mitigate these I.

2B-2Q. Full Analysis

2B. D3FEND Countermeasures

• D3-SPP -- Strong Password Policy D (Verify ID): Extending policy language to prohibit reuse completes the administrative control.

2C. Control Type Gap

I The Preventive technical control operates; what is missing is the administrative (directive) layer -- explicit policy prohibition. It matters for enforceability, for systems outside AD, and for audit defensibility.

2D. Regulatory Relevance

D FFIEC Information Security booklet (September 2016), Section II.C -- authentication guidance describes password controls established through policy. I Policy-configuration mismatches are low-severity but commonly noted documentation observations.

2E. KPIs

2F. Evidence of Closure

• I Revised password standard with explicit reuse prohibition, approval minutes.
• I GPO export (PasswordHistorySize=10 or greater) mapped to the policy clause.

2H. Detection Specification

2I. CIS Benchmarks

• D CIS Microsoft Windows Server 2022 Benchmark, Recommendation 1.1.1 "Ensure 'Enforce password history' is set to '24 or more password(s)'" -- CIS baseline (24) exceeds the bank's current 10 A.
• D CIS Controls v8.1, Safeguard 5.2 "Use Unique Passwords".

2K. Incident Scenario

I A teller reuses her AD password on a retail website that is later breached. The combo list circulates; an attacker stuffs it against the bank's webmail portal and succeeds -- AD password history never had a chance to intervene because the reuse happened outside the domain.

2L. Compensating Controls

I Without: Low-Medium. With enforced 10-password history: revised to Low for in-domain sequential reuse. Documentation-only gap overall.

2N. Data Classification Impact

I Indirect: whatever the stuffed account reaches -- email (NPI in correspondence) first, then application data per the account's entitlements.

2Q. Audit Test Procedures

• I Inspect password standard for reuse language; compare to GPO export. Evidence: policy extract, PasswordHistorySize setting.
• I Inquire whether breached-password screening appears in security awareness content.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

2B-2Q. Full Analysis

2B. D3FEND Countermeasures

• D3-SPP -- Strong Password Policy D: Distinct, stronger standard for admin accounts.
• Credential Rotation I: LAPS for local admin passwords removes long-lived shared secrets.
• D3-MFA D: MFA on administrative access reduces dependence on password strength alone.

2C. Control Type Gap

I Missing Preventive control: an elevated administrative-credential standard. Default admin accounts are shared, well-known usernames with total system control.

2D. Regulatory Relevance

D 12 CFR Part 364, Appendix B, III.C.1.a/c. FFIEC Information Security booklet guidance describes stronger controls for privileged access. I Privileged-credential management is a recurring examiner focus area.

2E. KPIs

2F. Evidence of Closure

• I Administrative credential standard distinct from user policy, approved.
• I LAPS/PAM deployment evidence covering local administrator accounts.
• I Sample verification (pwdLastSet, vault records) for built-in accounts on critical systems.

2H. Detection Specification

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 4.7 "Manage Default Accounts on Enterprise Assets and Software".
• D CIS Controls v8.1, Safeguard 5.4 "Restrict Administrator Privileges".
• D CIS Microsoft Windows Server 2022 Benchmark -- rename/disable built-in Administrator and Guest (Section 2.3.1).

2K. Incident Scenario

See combined scenario under 2.7 (RG-11) -- the two gaps compound.

2L. Compensating Controls

I Without: Medium-High. With RG-7 complexity + RG-8 lockout: revised to Medium -- online guessing is constrained. Limitation: lockout does not protect against offline cracking or vendor-published default credentials.

2N. Data Classification Impact

I Total-scope: default admin credentials confer platform-level access -- all data classes on the affected system plus authentication secrets enabling domain-wide escalation.

2Q. Audit Test Procedures

• I Inspect password/privileged-access standard for an elevated admin-credential requirement.
• I For a sample of servers and network devices, verify built-in account password age and vaulting status.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

2B-2Q. Full Analysis

2B. D3FEND Countermeasures

• D3-ACH -- Application Configuration Hardening D: Formal hardening baselines referenced by the build checklist.
• Platform hardening and scripted build verification I: Automated post-build compliance scanning (e.g., CIS-CAT) closes the "no automated verification" element.

2C. Control Type Gap

I Missing Detective/verification control on an unreliable Preventive one: the checklist exists but executes inconsistently, and nothing verifies its outcome. Unverified preventive controls fail silently.

2D. Regulatory Relevance

D FFIEC Architecture, Infrastructure, and Operations booklet (June 2021) -- configuration and change management. FFIEC Information Security booklet, Section II.C -- secure configuration guidance.

2E. KPIs

2F. Evidence of Closure

• I Versioned build standard referencing named hardening baselines (e.g., CIS Benchmarks per platform).
• I Automated post-build scan reports gating promotion, for a sample of recent builds.
• I Quarterly default-credential scan results with zero findings or tracked remediation.

2H. Detection Specification

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 4.1 "Establish and Maintain a Secure Configuration Process".
• D CIS Controls v8.1, Safeguard 4.7 "Manage Default Accounts on Enterprise Assets and Software".
• I Adopt the platform-specific CIS Benchmark as the "formal hardening documentation" the checklist currently lacks.

2K. Incident Scenario (combined G-006/G-007)

I A new branch network appliance is deployed under time pressure; the technician's copy of the build checklist is an older version without the credential-change step, and no scan verifies the result. The appliance sits on the internal network with its documented factory login. Months later, commodity malware on a workstation scans the subnet, tries vendor defaults from a public list, and gains the appliance's management plane -- traffic capture and a pivot point -- without triggering a single failed-password lockout. Because no elevated admin-credential standard exists (G-006), the same sweep also lands on two servers whose local Administrator passwords were set years ago to a shared, user-grade value.

2L. Compensating Controls

I Without: Medium-High. With network segmentation: revised to Medium. With quarterly vulnerability scanning including default-credential checks: revised to Medium-Low. Limitation: quarterly cadence leaves up to 90-day exposure windows.

2N. Data Classification Impact

I Platform-dependent: network appliances expose traffic containing NPI in transit; servers with default credentials expose whatever they store plus local authentication secrets for lateral movement.

2Q. Audit Test Procedures

• I Compare build checklists in use across recent deployments for version consistency and hardening references.
• I Re-perform: select 5 recently deployed assets and test for default credentials (with authorization).
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

2B-2Q. Full Analysis

2B. D3FEND Countermeasures

• D3-DAM -- Domain Account Monitoring D: Continuous, baselined monitoring tiered by system criticality.
• D3-LAM -- Local Account Monitoring D: Extends coverage to local privilege changes on critical servers.

2C. Control Type Gap

I The Detective control exists but is Execution-Limited: intermittent coverage, no criticality tiering, and analyst desensitization. A detective control that fires but is not watched protects the record, not the bank.

2D. Regulatory Relevance

D 12 CFR Part 364, Appendix B, III.C.3 -- monitoring systems (binding). FFIEC Information Security booklet, Section II.C -- risk-prioritized monitoring. I "Alerts generated but not worked" is a pattern examiners commonly identify.

2E. KPIs

2H. Detection Specifications

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 8.2 "Collect Audit Logs", 8.9 "Centralize Audit Logs", 8.11 "Conduct Audit Log Reviews".
• D CIS Microsoft Windows Server 2022 Benchmark -- "Audit Security Group Management" and "Audit User Account Management" (Section 17).

2K. Incident Scenario

See combined scenario under 2.9 (RG-13) -- the two gaps are one failure chain.

2L. Compensating Controls

I Without: High. With existing (degraded) alerting: revised to Medium-High -- events are collected, enabling retrospective investigation. Compensation is forensic, not protective.

2Q. Audit Test Procedures

• I Obtain SIEM rule inventory and coverage mapping for privilege-change events per critical system.
• I Select 20 privilege-change alerts from the last quarter; test disposition and timeliness.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

2B-2Q. Full Analysis

2C. Control Type Gap

I The Corrective/response linkage is missing: detection without a documented response procedure breaks the detect-to-respond chain. RG-12 and RG-13 jointly demonstrate that Heritage owns the tooling but not the operating discipline.

2D. Regulatory Relevance

D 12 CFR Part 364, Appendix B, III.C.3 (monitoring) and III.C.1.g (response programs) -- binding. FFIEC Information Security booklet, Section II.C -- incident identification and response. I Examiners commonly trace sampled alerts to their disposition.

2E. KPIs

2F. Evidence of Closure

• I Approved privilege-alert investigation runbook (triage steps, escalation criteria, SLA, evidence handling).
• I Quarter of ticketing records showing runbook-conformant dispositions.
• I Tabletop or live test of the runbook with lessons-learned record.

2H. Detection Specification

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 8.11 "Conduct Audit Log Reviews" and Control 17 "Incident Response Management".

2K. Incident Scenario (combined G-002/G-003)

I An attacker with a phished IT-support credential creates a new domain account at 7:40 p.m. and adds it to a server-operators group. Both events generate SIEM alerts -- into a queue averaging hundreds of daily entries with no criticality tiering. The analyst on rotation, conditioned by months of false positives, bulk-acknowledges the overnight queue. No investigation process exists to force a second look. The persistence account operates for six weeks, staging data from the loan-imaging server, until an unrelated storage alert exposes the transfer volume. The post-incident timeline shows the bank detected the intrusion on day one and processed that detection as noise.

2L. Compensating Controls

I Without: High. With alert generation intact: revised to Medium-High -- forensically recoverable, operationally blind.

2Q. Audit Test Procedures

• I Request the documented investigation process for privilege alerts; absence is the finding.
• I Walk through the five most recent triggered privilege alerts end-to-end with the analyst.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

Note: this gap is a risk multiplier for G-005 (creep) and G-011 (termination lag) I.

2B-2Q. Full Analysis

2B. D3FEND Countermeasures

• D3-UAP -- User Account Permissions D: Automated, template-driven permission assignment.
• Authentication/credential eviction I: Automated revocation on lifecycle events.

2C. Control Type Gap

I Missing automation of preventive and corrective execution: the design (ServiceNow request -> approval) is sound, but the execution hop into AD is human.

2D. Regulatory Relevance

D The CRI text makes automation an explicit expectation ("actively managed or automated"). FFIEC guidance contemplates timely, accurate provisioning/deprovisioning. I Manual processes are not findings in themselves; examiners focus on whether the manual process achieves timely revocation.

2E. KPIs

2H. Detection Specification

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 5.6 "Centralize Account Management" and 6.7 "Centralize Access Control".

2K. Incident Scenario

I A ServiceNow ticket approves "read access to the credit-analysis share" for a new analyst. The administrator manually picks the adjacent group -- "CreditAdmin" instead of "CreditAnalyst." Nothing reconciles executed changes against approved requests, no owner reviews the share (G-001), and no alert distinguishes the grant. The analyst holds administrative rights over the credit data for a year; when her account is later compromised, the attacker inherits admin control the bank never knew it had granted.

2L. Compensating Controls

I Without: Medium. With ServiceNow request capture (existing): revised to Medium-Low for traceability. With D-2.10-1 reconciliation rule (buildable now): further reduced.

2Q. Audit Test Procedures

• I Reconcile 25 executed AD changes against approved ServiceNow requests (existence and match).
• I Inspect for any auto-revocation capability on role change; absence is the finding.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.

2A. ATT&CK Techniques

Physical access badge retention is a real exposure A but not modeled in ATT&CK Enterprise terms; treated in scenario and remediation I.

2B-2Q. Full Analysis

2B. D3FEND Countermeasures

• Account Locking I: Immediate lock at HR-effective time is the direct countermeasure.
• Authentication Cache Invalidation I: Killing active sessions/tokens at termination closes the gap left when only the password is disabled.
• D3-MFA D: Deactivating the MFA token provides a second revocation lever.

2C. Control Type Gap

I The Corrective control exists but is Execution-Limited in speed and Scope-Limited in coverage: 2-3 days for AD; unsynchronized for physical and third-party access. The CRI text's standard is "immediately" D.

2D. Regulatory Relevance

D 12 CFR Part 364, Appendix B, III.C.1.a and III.C.2. FFIEC Information Security booklet, Section II.C -- prompt removal of access upon termination. I Termination-timeliness testing is one of the most standard examiner and auditor procedures; a systematic 2-3 day lag commonly draws attention.

2E. KPIs

2F. Evidence of Closure

• I Revised termination runbook with same-day SLA and a named executor per access class.
• I Three months of termination-timeliness reporting meeting SLA.
• I Quarterly third-party app reconciliation results against the HR active roster.

2H. Detection Specifications

2I. CIS Benchmarks

• D CIS Controls v8.1, Safeguard 6.2 "Establish an Access Revoking Process".
• D CIS Controls v8.1, Safeguard 5.3 "Disable Dormant Accounts".

2K. Incident Scenario

I A back-office employee resigns after a dispute and works a final Friday. Her AD account is queued for the standard process -- disable expected Tuesday or Wednesday. Over the weekend she logs into webmail and the third-party loan-participation portal (never on the termination checklist), downloads customer statements and pipeline data, and badges into the operations area on Saturday because physical access is handled by facilities on its own schedule. Every action authenticates successfully as an authorized user; nothing alerts because no terminated-user detection exists. The bank learns of the exfiltration when a competitor's outreach to customers triggers complaints.

2L. Compensating Controls

I Without: High. With the immediate high-risk path (existing): revised to Medium-High -- the worst-case hostile termination is covered if HR correctly classifies risk. With D-2.11-1 compensating detection (buildable in days): revised to Medium.

2N. Data Classification Impact

I Highest-materiality gap for data exposure in this statement: customer NPI and financial records (email, core, loan systems, third-party portals), employee PII, and authentication secrets (active sessions, cached credentials, MFA tokens still enrolled). Physical access adds paper records and unattended-workstation exposure.

2Q. Audit Test Procedures

• I Obtain the HR termination list for the trailing 6 months; compare termination-effective dates to AD disable timestamps, badge deactivation, and third-party app removal dates. Evidence: HR extract, AD whenChanged/disable logs, badge records, SaaS admin logs; lag distribution schedule.
• I For 5 sampled terminations, test for post-termination authentication events in any log source.
• I CRI EEE Package: PR.AA-01.01 evidence package -- Verify package ID.