If users forget their password, lose their one-time-password tokens, or otherwise become unable to access their accounts, they call the help desk.
In certain circumstances, help desk support is allowed to set a temporary password and suspend multi-factor requirements. This is kept to a minimum, but is unavoidable. As far as we can tell, nothing malicious has been done. Yet.
I was thinking of adding a step for the help desk team to note certain details every time they have to do this (time, account, phone number, ...) and following up with the account holder to make sure everything is OK, but this could leave hours of an attacker having access to a system.
Is there a standard approach to detecting someone maliciously getting a password reset to gain illegitimate access to an account?
Is there a way I could restrict the permissions of any account that had a password reset or multi-factor suspension automatically?