Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-24 09:28:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 52

handbook: security account recovery process update (#9804)

Browse source
This commit is contained in:
Charlie Chance 2023-02-13 11:15:26 -07:00 committed by GitHub
parent 26931c178d
commit 6e0626a01c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
handbook/business-operations/security.md
View file

@ -34,16 +34,16 @@ As an all-remote company, we do not have the luxury of seeing each other or bein
Here are the steps we take for the recovery process:
1. If the requester still has access to Slack, they ask for help in *#help-login*. If they do not have access to Slack, they can contact their manager or a teammate over the phone via voice or texting, and they will post in *#help-login* for the requester.
1. If the requester still has access to Slack, they ask for help in `#help-login`. If they do not have access to Slack, they can contact their manager or a teammate over the phone via voice or texting, and they will post in `#help-login` for the requester.
2. A recoverer acknowledges the request in #help-login using the "eyes" emoji 👀.
3. The recoverer identifies the requester through a live video call.
* If the recoverer does not know the requester well enough to positively identify them visually, the
recoverer can ask a colleague whom they recognize to act as the identifier. **All three must be
live on a video call at the same time.**
* For example, if the recoverer does not recognize Guillaume but can recognize Zach, they should ask Zach to identify Guillaume. Using the requester's manager or a direct teammate is recommended, as it increases the chances they frequently see each other on video.
* For example, if the recoverer does not recognize Sam but can recognize Zach, they should ask Zach to identify Sam. Using the requester's manager or a direct teammate is recommended, as it increases the chances they frequently see each other on video.
4. If the recoverer recognizes the requester or has the identity confirmed by the person acting as
the identifier, they can perform the recovery and update the thread in *#help-login*.
* If the recoverer is not 100% satisfied with identification, they do **NOT** proceed and post to #g-security to engage the security team immediately.
the identifier, they can perform the recovery and update the thread in `#help-login`.
* If the recoverer is not 100% satisfied with identification, they do **NOT** proceed and post to `#help-manage` to engage the security team immediately.
## How we protect end-user devices