3

We are designing the security for a B2B Saas service, the user and admin accounts are based on the customer's email addresses - typically our customers are small organisations without their own in house IT people etc

We need a secure way of verifying a request to create a new administrator account when the customer is saying the existing administrator (who would normally approve these requests) are no longer around - e.g. someone left the company in a hurry

How do we verify identity before creating a new admin account?

Thanks in advance for any help

2
  • When you say customer's email addresses, do you mean the emails belong to a domain, like [email protected]?
    – amccormack
    Commented May 15, 2015 at 20:19
  • yes the emails will belong to a customer specific domain
    – rpg II
    Commented May 16, 2015 at 10:56

2 Answers 2

4

This can be a particularly tricky problems. You're approach should match the size of your business (will your solution scale), and the sensitivity of the information.

If you look at a company like Trello, they won't change Administrators for you. If I had to guess their reason for this, it is because the risk of them exposing your data doesn't justify losing your business. Most likely, this happens to smaller companies (who don't designate multiple admins), and thus, their loss of revenue is either nothing (the customer is on the free tier) or the $3.75/month/user. It is better to lose one customer because the customer didn't have exit procedures in place than to lose many customers because a data breach occurred.

For other businesses, where larger amounts of money are involved, it may be worth the extra effort of working with the company to change the Administrator.

Put in technical barriers to prevent this from happening

The best solution is to keep this from happening in the first place. Here are some ideas you could implement:

  • Require two administrators at signup. You can restrict the backup administrator to have only the access to assign a new administrator. Further, you can assign a multi day delay to the assignment right, so that if the original administrator is still in play, they can veto an invalid assignment.

  • Require the administrator to establish a backup administrator, triggered by a dead man's switch. If the primary administrator doesn't log in after so many days, the backup administrator is promoted.

  • Establish a random one time use password to be delivered and retained by the company's legal counsel.

If the technical barriers aren't in place, how should you proceed?

  • You should encourage the company to resolve this issue by contacting the original admin, and having the admin designate a new administrator.
  • If the original account email was apart of a company domain, the company should use the Forgot Password feature, log into the original administrator email, and reset the password. They may have to reenable the mailbox to do this.

Last resort tactics

First things first, make sure your customers are aware of your Administrative change policy. Give them the ability to opt out or to possibly modify the terms. This should get you some additional coverage if this process is abused to expose sensitive data.

These ideas are going to require human intervention and review, it may be better to charge a fee for this process than to automate it. You want to be as diligent as possible.

  • Ensure no one is responding to the original email address, and that the relevant user hasn't logged in recently. This should be your first step.
  • Have them mail you a notarized letter on company letterhead. Obviously the letterhead can be forged, but the idea here is you want to hold some real person accountable (You have to show ID to the notary), should this process be abused. This letter should contain a random token that was emailed to the person who is sending the letter. The email should belong to the customer domain.
  • Account Fees. If you are authorized to make deposits against a banking account, you may be able to make three random transactions (typically, all less than a dollar), the result of the transactions should be a net balance of 0, but if the user can identify the transaction amounts, you know they have access to the banking information.
  • Notify other members of the company. You may want to send emails to all or a portion of the remaining users on the account that this process is taking place. If you have a phone number from the billing details, call the number. The idea is to give the company a heads up that this will take place should something nefarious be going on. Give them a phone number or email address to contact if they suspect something is wrong.
1

My suggestion would be to send something to the companies registered address e.g. a code they can read back to you, or a URL to create a new account. I would address the letter to the job title of the previous administrator e.g. "To The Technical Director". This gives it the best possible change of reaching the person performing the duties of the previous administrator, and it solves the problem of having received a false request when the previous administrator is in fact still working for the company.

Possible problems:

  1. Letters can be intercepted/may be opened by someone other than the intended recipient
  2. If the previous administrator has left, they may still have retained access to their login details so can continue to access the system until revoked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .