I feel bad for cks, but I probably would have handled it a little differently... - shut their accounts off network-wide - drop all related network connections

I feel bad for cks, but I probably would have handled it a little differently... - shut their accounts off network-wide - drop all related network connections - forcibly reset their password and make them choose a new one in person. They may have changed it earlier, but do it again - increase logging to catch any potential reoccurrences against the same user or other users - inspect ACLs and reduce access for all users if possible - prevent users from connecting from areas outside of their usual network sphere - let the user back on, and ask them to be more careful in the future - better mail filtering would be nice, but they'll always find a way to beat the spam filter - (i hate this option the most, but...) send fake scam emails internally to see if anyone else takes the bait This is of course ignoring 2fa, but 2fa isn't perfect either with sim swapping... but I personally don't think changing the password is enough for an event like this.