25 lines
1.2 KiB
Markdown
25 lines
1.2 KiB
Markdown
|
# Playbook: Loss of Admin Identity
|
|||
|
|
|
|||
|
|
**Triggers:** locked out of registrar, Gitea, Stripe, Bubble, email, cloud; lost MFA device.
|
|||
|
|
|
|||
|
|
## Steps
|
|||
|
|
|
|||
|
|
1. **Identify which identity** — registrar, payment, forge, email, secrets vault.
|
|||
|
|
2. **Break-glass account** — use documented secondary admin if available (see `AssetRegister.yaml` recovery_path).
|
|||
|
|
3. **Offline recovery codes** — MFA reset via vendor recovery flow; requires pre-stored codes.
|
|||
|
|
4. **Vendor support** — IONOS/Stripe identity verification; allow 24–48h; have domain ownership proof ready.
|
|||
|
|
5. **Verify ownership** — confirm domain/registrar records unchanged; check for hostile transfer.
|
|||
|
|
6. **Rotate compromised identity** — new password, new MFA, revoke active sessions.
|
|||
|
|
7. **Restore dependent access** — Gitea/Forgejo admin, DNS, backup admin, OpenBao.
|
|||
|
|
8. **Update registers** — record recovery paths discovered; close gaps in `AssetRegister.yaml` T0 section.
|
|||
|
|
9. **Document** — evidence log; **no recovery codes in Git**.
|
|||
|
|
|
|||
|
|
## Prevention (ongoing)
|
|||
|
|
|
|||
|
|
- Record backup admin contacts per T0 asset.
|
|||
|
|
- Store MFA recovery codes in password manager.
|
|||
|
|
- Registrar lock enabled.
|
|||
|
|
|
|||
|
|
## References
|
|||
|
|
|
|||
|
|
`AssetRegister.yaml` T0 · `PanicSheet.md` §2 · `ResiliencePolicy.md`
|