Considering an online banking or paypal-type web application with

  • username/password login and
  • two factor authentication (2FA) for transactions

What are best practice security measures for damage control, assuming

  1. username/password or
  2. username/password and 2FA

have been compromised.

I can only think of transaction logs that allow understanding and reverting all malicious transactions made. What else is commonly used?

  • All of them....
    – user81147
    Commented Jun 7, 2017 at 15:50

3 Answers 3


Most banking sites limit the amount of money transferred in a specific timeframe. You will not be able to perform transactions that have a greater value than say € 5000.00 in a single 24 hour period without prior notice to your bank. This prevents/limits the most harmful cases of fraud.

Additionally all (at least all german banks) will use some sort of second factor per transaction that requires the users specific consent for every transaction.

A transaction log is always a good idea, and can be used as a valuable feature for your customers too.

  • Thanks for the answer. 2FA is already mentioned in the question and is assumed to be compromised. Commented May 8, 2017 at 13:50

It is difficult to balance damage control mechanisms and usability. Some mechanisms are deemed intrusive by a user while some can be abused by phishers for social engineering.


  1. Notify the user via SMS when online transaction is made from "uncommon" Geo-IP address.
  2. Notify the user when "unusual" transfer is made other than the usual entity
  3. Enable a "cool down" period for transaction figure for X amount. If the user change the limit, notify the user via SMS.

Damage Control is pretty broad so I would actually have you categorize them more, for example ask:

What information does the company need to prevent a breach?

Ideally, nobody wants to be breached, or at a minimum we want our reaction time to be so good as to limit harm. This can be location based tracking, time of use tracking, habit tracking, standard Username/password w/ 2FA, device usage, policies etc.

This are things that a company does actively to:

  • Warn of potential issues
  • Interact with their customers securely
  • Develop apps securely

What information does the company need to resolve the breach?

The adage of "it's not if but when something happens" is pretty prevalent. Once something occurs, what is the fastest way to resolve it? What are auditors, legal and/or law enforcement going to need or want?

This might be audit logs, transaction logs, location logs. This really focuses on:

  • Information to collect
  • Information Security Response teams / policy
  • Risk mitigation
  • Compliance

How do you communicate with user?

The first two are straight forward, this one varies greatly since it's your direct interaction with users. This is really PR/company driven and the things you might think about are:

  • What details are you willing to release?
  • What is adequate compensation?
  • What is regulated?

This last one honestly is not my forte. I personally want all the detail and feel the Who, What, When, Why, and How of a breach of should be fully communicated. I know plenty of people in the security community who don't feel this way, and certainly not my executive level who have to consider the entire company.

Above all, this is not an individual issue or even a single business units responsibility, you really need to drive it all levels.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .