Phishing of service desk staff leading to access to a customer tenant

Service desk engineers handle password resets and sign in to customer tenants all day, so attackers aim convincing mails and phone calls at them. A successful phish could hand over a session with the rights to reset customer accounts.

Measures

Staff take a phishing exercise every quarter, and the service desk calls the customer back on a known number before any reset. The residual score stays where it is until the exercises show fewer clicks.