A county account settings page lets an already authenticated user change the password without re-entering the current password or completing step-up MFA. Why is this a problem if a session was stolen?
Select an answer to reveal the explanation.
Short Explanation
If someone nicks your unlocked desk badge, they should not also get to swap the door code without a second check. Password changes without re-auth or step-up MFA turn a stolen session into lasting account takeover. Logout is not the only sensitive action.
Full Explanation
A county account-settings page that lets an already authenticated user change the password without re-entering the current password or completing step-up MFA weakens account takeover resistance: a stolen session can permanently seize the mailbox or portal identity. Sensitive account changes should re-authenticate or require step-up MFA.
Stolen sessions often can change passwords without physical badge access—that option invents a nonexistent requirement. Browsers do not block Set-Cookie on municipal sites as a general password-change safeguard. Requiring re-authentication only for logout while exempting password changes inverts priorities.
Exam caveat: step-up may be password re-entry, MFA challenge, or equivalent; the concept is fresh proof of presence for high-risk actions.
Operational check: with an authenticated civic session, attempt a password change without current-password or MFA step-up and record whether the server accepts it. Recommend mandatory re-auth for password, email, and MFA-reset changes on county identity portals. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.