SCARP
CS-1042
Illustrative — not customer data
Report date: 30 August 2026
Prepared for: illustrative B2B SaaS attack surface
Change-set review
CS-1042: Admin takeover
4 paths · 8 evidence entries · Owner Platform engineering
Decision
Require MFA at workforce identity
Cuts the three sign-in routes that share the workforce identity policy. The staging admin host signs in separately and needs a change of its own.
- Owner
- Platform engineering
- Effort / disruption
- 1–2 days · Medium
- Projection confidence
- 86%
Projected
3
paths expected removed
Realized
3
paths confirmed removed
Remaining
1
path still reachable after re-check
Still reachable after re-check
staging-admin.example still reaches prod-data: it authenticates against separate local credentials, outside the identity policy the change tightened.
Change-set comparison
The selected change is shown beside the alternative that was considered. Only the selected change shipped, so only it has a re-check result.
Illustrative alternatives
Selected change
Require MFA at workforce identity
- Owner
- Platform engineering
- Effort
- 1–2 days
- Disruption
- Medium
- Expected paths removed
- 3
- Realized paths removed
- 3
Considered, not shipped
Retire the legacy webmail endpoint
- Owner
- IT operations
- Effort
- 1–2 sprints
- Disruption
- High
- Expected paths removed
- 1
- Realized paths removed
- Not re-checked
Audit closure line · 30 August 2026
Change set CS-1042, owned by Platform engineering, was reviewed under the 48-hour SLA. Observation obs_31bc and closure closure_9cd2 tie the projected 3-path reduction to 3 paths confirmed removed, with 1 of 4 still reaching the asset; verification: MFA challenge on each sign-in route, plus staging reachability.
Evidence register
Illustrative data — not customer output.
| Stage | Entity | Detail | Evidence | Source | Confidence | Freshness |
|---|---|---|---|---|---|---|
| entry | vpn.example | Public VPN portal with password sign-in | observed | Passive external observation | 95% | 27 Aug 2026, 09:14 UTC |
| entry | webmail-legacy.example | Legacy webmail with password sign-in | observed | Passive external observation | 95% | 27 Aug 2026, 09:14 UTC |
| entry | sso.example | Direct single sign-on page | observed | Passive external observation | 95% | 27 Aug 2026, 09:15 UTC |
| entry | staging-admin.example | Admin host with separate local credentials | observed | Passive external observation | 95% | 27 Aug 2026, 09:16 UTC |
| control | Workforce identity | Password-only sign-in policy, no MFA | validated | Operator-authorized validation | 97% | 27 Aug 2026, 11:02 UTC |
| asset | Admin console | Privileged application behind workforce sign-in | inferred | Reachability correlation | 72% | 27 Aug 2026, 09:20 UTC |
| asset | prod-data | Production customer data | inferred | Reachability correlation | 72% | 27 Aug 2026, 09:20 UTC |
| impact | Administrative takeover | Customer data and configuration access | inferred | Reachability correlation | 72% | 27 Aug 2026, 09:20 UTC |