Credential Compromise

1. One suspicious signal does not prove the compromise boundary

A new-device login, recovery-channel change, leaked-password signal, or unexpected session is evidence to inspect, not a complete diagnosis. The affected path may be an authenticator, an existing session, a delegated token, or a recovery path. This lesson keeps unsupported dimensions UNKNOWN rather than turning one signal into a takeover story.

2. Keep four states separate

Track authenticator state, session state, recovery state, and delegated-access state independently. A password change affects the relevant authenticator but does not automatically prove that existing sessions or tokens ended. Conversely, a stolen session can exist while the primary authenticator remains intact.

3. What NIST says about authenticator compromise

NIST SP 800-63B-4 requires compromised authenticators to be promptly suspended, invalidated, or destroyed after compromise detection and defines invalidation as removal of the binding between the authenticator and subscriber account. [NIST-63B4] That authority is about the authenticator boundary; it is not proof that every application session or delegated token has also ended.

4. MFA matters, but it is not closure proof

OWASP describes MFA as a strong defense against most password-related attacks such as credential stuffing and recommends layered defenses and monitoring. [OWASP-CREDENTIAL] MFA is therefore an important control, not evidence that no stolen session, abused recovery route, or residual delegated access exists.

5. Build a timeline, not a narrative

Record signal time, authenticator changes, session creation or continuation, recovery changes, and token activity separately. A timeline distinguishes “observed after reset” from “closed because of reset.” If ordering is unknown, do not invent causality.

6. Bound blast radius path by path

Blast radius is the set of access paths that evidence shows can still act: authenticator, active session, delegated token, or recovery route. Scope it from observed state rather than worst-case imagination. When evidence is incomplete, keep the radius bounded and mark uncertainty explicitly.

7. Suspicious login is not the same as takeover

A login from a new IP or device can be legitimate. Classification needs corroborating evidence, state inconsistency, or access-path evidence. The negative-control case in this lesson contains a suspicious recovery change later proven legitimate; it must not be escalated to confirmed takeover without support.

8. Separate containment from recovery

Containment can suspend a suspected authenticator, terminate a session, revoke a token, or freeze a recovery path. Recovery restores legitimate access and independently verifies that the compromised path is closed. Containment should be bounded and reversible where practical.

9. Password rotation closes only one path

If a password authenticator is compromised, rotation can be part of recovery. But one fixture deliberately keeps an old session valid after password rotation. Closure therefore has to inspect the session registry, token state, and recovery state separately.

10. Session compromise is not identical to credential compromise

The transfer fixture keeps the authenticator healthy while a stolen session becomes the primary concern. The bounded response is session termination and scope review, not automatically rotating every credential. This distinction reduces both blind spots and unnecessary response.

11. Do not forget delegated tokens

An API token or delegated grant can remain usable after authenticator invalidation depending on architecture. Record token scope and revocation state independently. If token state is unknown, full containment cannot be claimed.

12. Recovery is itself an access path

An unauthorized email, phone, or recovery-factor change can create persistence. Verify whether the recovery change was authorized before declaring restoration complete. If evidence cannot resolve the boundary, OPEN_BOUNDARY_UNRESOLVED is a valid state.

13. Closure needs an independent probe

After containment, do not merely re-read the original symptom. Verify authenticator invalidation or binding state, session termination, token revocation, and authorized recovery state independently for the paths in scope. Close only what the evidence closes and preserve residual uncertainty.

14. Lab: eight fixtures and 64 assertions

The lab is fully local and synthetic. Eight cases cover a safe baseline, authenticator compromise, a session surviving password rotation, residual delegated token access, recovery-path compromise, a false-positive recovery signal, incomplete evidence, and a stolen-session transfer case. The hidden evaluator checks eight outputs per case for 64 assertions.

15. Exit checklist and claim boundary

Before exit, separate the four access-path states, reject at least one alternative with evidence, bound blast radius, distinguish containment from closure, preserve UNKNOWN, rebuild the transfer case from fresh evidence, and state that passing the synthetic fixture proves only bounded lesson reasoning—not absence of compromise in a real system.