tegwick
d011073e16
Expand AssetRegister and DataRegister with T0/T4 stack assets. Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five incident playbooks. Update README with mirror status. Mark T02-T05, T07-T08 done; T01 and T06 in progress.
25 lines
No EOL
1.2 KiB
Markdown
25 lines
No EOL
1.2 KiB
Markdown
# Playbook: Loss of Admin Identity
|
||
|
||
**Triggers:** locked out of registrar, Gitea, Stripe, Bubble, email, cloud; lost MFA device.
|
||
|
||
## Steps
|
||
|
||
1. **Identify which identity** — registrar, payment, forge, email, secrets vault.
|
||
2. **Break-glass account** — use documented secondary admin if available (see `AssetRegister.yaml` recovery_path).
|
||
3. **Offline recovery codes** — MFA reset via vendor recovery flow; requires pre-stored codes.
|
||
4. **Vendor support** — IONOS/Stripe identity verification; allow 24–48h; have domain ownership proof ready.
|
||
5. **Verify ownership** — confirm domain/registrar records unchanged; check for hostile transfer.
|
||
6. **Rotate compromised identity** — new password, new MFA, revoke active sessions.
|
||
7. **Restore dependent access** — Gitea/Forgejo admin, DNS, backup admin, OpenBao.
|
||
8. **Update registers** — record recovery paths discovered; close gaps in `AssetRegister.yaml` T0 section.
|
||
9. **Document** — evidence log; **no recovery codes in Git**.
|
||
|
||
## Prevention (ongoing)
|
||
|
||
- Record backup admin contacts per T0 asset.
|
||
- Store MFA recovery codes in password manager.
|
||
- Registrar lock enabled.
|
||
|
||
## References
|
||
|
||
`AssetRegister.yaml` T0 · `PanicSheet.md` §2 · `ResiliencePolicy.md` |