When an attacker controls your CASB or security service edge tenant, they control what every user can reach, what is inspected and which SaaS data the platform can read on their behalf. A compromise may come through a stolen administrator session, a leaked management API key, an exploited private access connector or a breach at the provider itself. This playbook is for incident responders, network and cloud security engineers and platform owners who need to contain the incident without cutting the organisation off from the internet, rotate the many machine credentials the platform holds, and rebuild trust in its policy. It is vendor-neutral and describes a common SSE architecture: confirm exact menu and API names with your provider. Hardening before an incident is covered in Securing the CASB and SSE platform itself.
Key takeaways
- Decide steering before you touch anything. Pulling the client or failing open removes inspection for everyone, so choose fail-open, fail-closed or a reduced path deliberately and record the decision.
- The platform is a credential store. SaaS API connector grants, SCIM tokens, log streaming keys, identity provider trusts, connector enrolment keys and the inspection CA all need rotation, not just administrator passwords.
- Revocation is not instant. Access tokens already issued stay valid until they expire unless the issuer supports revocation, so revoke at the SaaS side and watch for use after revocation.
- Private access connectors are inside your network. Treat a connector host as a compromised edge device: isolate, preserve, rebuild from a clean image and re-enrol with new keys.
- Restore policy from an export you trust. Diff the live tenant against the last approved configuration export; an unexplained bypass or widened access rule is both evidence and the first thing to revert.
How the compromise shows up
SSE incidents rarely start with a malware alert. They usually show as a configuration or identity anomaly in the platform's own audit log, a provider security notice, or an unexplained change in traffic.
| Signal | Where you see it | What it may mean | ATT&CK |
|---|---|---|---|
| Bypass, allow or steering exception added outside change control | Tenant admin audit log, configuration diff | Attacker removing their own traffic or a target destination from inspection | T1685 Disable or Modify Tools |
| New tenant administrator, API key or local admin account | Admin audit log, identity provider sign-in log | Persistence in the tenant | T1078.004 Cloud Accounts, T1098.001 Additional Cloud Credentials |
| Private access policy widened to "all users" or a new application segment published | Policy audit, private access logs | A new route into internal applications | T1199 Trusted Relationship |
| Unexpected connector registered or a connector host making new outbound connections | Connector inventory, host EDR, firewall logs | Attacker-controlled connector or compromised connector host | T1078.004, T1685 |
| CASB API connector reading or exporting far more content than normal | SaaS tenant audit logs (not only the CASB's own logs) | Stolen connector token used for collection | T1528 Steal Application Access Token, T1550.001 Application Access Token |
| Log streaming disabled or destination changed | SIEM ingestion gap, admin audit log | Blinding before or during activity | T1685 |
| Provider security advisory or breach notice | Provider status page, account team, threat intelligence | Provider-side compromise affecting tenant data or keys | T1199 |
Pull the SaaS providers' own audit logs early. A connector token used from outside the CASB's documented egress addresses is a strong indicator, and those logs are outside the attacker's reach if they only hold the SSE tenant.
Triage: the first hour
- Confirm and scope the entry point: was it an administrator identity, a management API key, a connector host, the endpoint client, or the provider? Each has a different containment path below.
- Freeze the evidence: export the admin audit log, current configuration and connector inventory through the API before you change anything, and hash the files. Some services keep audit history for a limited time, so export now rather than later.
- Compare with the last good export: diff policies, bypass lists, application segments, admin roles, API keys and identity trusts against the last approved configuration in version control.
- Identify blast radius: list which SaaS tenants have API connectors, which internal application segments each connector can reach, and which devices trust the inspection CA.
- Open a provider case: ask for provider-side admin activity, support access to your tenant and any related advisories. Under CSF 2.0 RS.MA-01 the response plan runs in coordination with relevant third parties.
- Decide steering: agree with the incident lead and business owners how traffic flows while you contain (next section).
The steering decision: fail-open, fail-closed or reduced path
| Option | When to choose it | Risk | Compensating controls |
|---|---|---|---|
| Keep the platform in path, lock the tenant | Compromise limited to one admin identity or API key, configuration diff is small and understood | Hidden persistence keeps operating while you clean up | Revert diff, rotate all tenant credentials, two-person rule on every change during the incident |
| Fail-closed for high-risk paths | Private access connectors or ZTNA policy are suspect | Users lose access to internal applications | Temporary access through a separate, monitored path for critical staff; break-glass procedure |
| Fail-open for web traffic | Tenant integrity unknown and business needs internet access | No inspection, URL filtering or inline DLP | Endpoint protection, DNS filtering, identity provider conditional access, heightened SIEM monitoring |
| Disconnect connectors, keep web inspection | Connector host compromised, tenant clean | Internal apps unreachable remotely | Stand up clean connectors in a new segment before reopening |
Record who approved the choice and when it will be reviewed. Small organisations with one platform and no alternative path usually choose fail-open web with endpoint and DNS controls; large ones should already have a documented secondary path for administrators. See the SASE and SSE Guide for fail-open and fail-closed design.
Containment by priority
Contain in the order that removes the attacker's control fastest while keeping enough access for the response team.
- Administrator access: disable unknown admin accounts, revoke all console sessions, remove unknown API keys and reduce standing administrators to the response team. Use the documented break-glass account if identity provider trust is in doubt. See the Break-Glass Account Guide.
- Identity trust: check SAML or OIDC settings for an added or replaced signing certificate or a second identity provider, and check SCIM for groups created outside the provisioning source. A forged-assertion path (T1606.002 SAML Tokens) survives password resets. If the identity provider itself is suspect, run the Identity Provider Tenant Compromise Playbook in parallel.
- Policy integrity: revert bypasses, allow-list entries and widened private access rules found in the diff. Lock policy publishing to two named people for the rest of the incident.
- Private access connectors: disconnect suspect connectors at the tenant and at the network edge, preserve the host, and block the host's outbound paths except to forensic collection. Keep threat hunting on internal systems the connector could reach, as CISA directed for compromised remote access gateways in Emergency Directive 24-01.
- SaaS API connectors: revoke the CASB's grants at each SaaS provider, not only inside the CASB, and review each SaaS audit log for activity by the connector identity since the earliest suspect date.
- Endpoint client: invalidate client disable or uninstall codes and look for devices where the client was stopped or removed during the incident window.
- Logging: restore log streaming to a destination SSE administrators cannot change and confirm events are arriving.
Credential and key rotation inventory
The CISA Ivanti directive is a useful model for any access gateway: revoke and reissue connected or exposed certificates and keys, reset the admin enable password, reset stored API keys and reset local user and service account passwords used for authentication server configuration. Apply the same thinking to every non-human identity the SSE platform holds.
| Credential | Where to revoke | Watch for after rotation |
|---|---|---|
| Tenant admin sessions and API keys | SSE console and identity provider | Sign-in attempts with old keys, new key creation |
| CASB API connector grants (OAuth or app credentials) | Each SaaS tenant's app consent and app registration | Token use from unknown addresses after revocation |
| SCIM provisioning token | SSE tenant; reissue to identity provider | Group or user changes not made by the provisioning source |
| SAML or OIDC signing certificates and client secrets | Identity provider and SSE tenant | Assertions signed by the old certificate |
| Connector enrolment keys and connector certificates | SSE tenant | Registration attempts with retired keys |
| Log streaming and SIEM integration keys | SSE tenant and log destination | Writes from the old key, ingestion gaps |
| Service accounts used by connectors (directory lookups, Kerberos) | Directory; reset twice and revoke tickets | Authentication from connector hosts with old credentials |
| TLS inspection CA | Provider key store or your HSM; device trust stores | Certificates issued by the old CA after the cut-over date |
- Token lifetimes: RFC 7009 says revoking a refresh token should invalidate access tokens from the same grant where the server supports it, but self-contained access tokens cannot be revoked immediately. One major identity provider documents that its access tokens last one hour by default and keep working after refresh token revocation unless the application supports continuous access evaluation. Plan for a window of residual access and monitor it.
- The inspection CA: if there is any chance the CA private key was exported, treat it like a compromised key: issue a new CA, push it to device trust stores, then remove the old CA everywhere. A stolen inspection CA lets an attacker in the network path impersonate any site to managed devices (T1557 Adversary-in-the-Middle). See the TLS Inspection Guide.
- Rotate everything once, in a planned order: the Cloudflare Thanksgiving 2023 breach showed that a handful of credentials left unrotated after a supplier incident is enough for a return visit.
Eradication and rebuild
- Rebuild connector hosts: do not clean them. Build new hosts from a trusted image on a supported version, place them in a fresh, narrow segment, enrol them with new keys and decommission the old hosts after evidence is preserved. CISA's directive followed the same pattern for gateways: export configuration, factory reset, rebuild on a supported version, then reimport.
- Re-baseline the tenant: rebuild policy from the last approved export rather than editing the live state, then apply legitimate changes made since that export one by one with approval.
- Re-scope SaaS connectors: re-grant each API connector with the minimum scopes its policies need, using certificate or federated credentials where the SaaS supports them. The Salesloft Drift breach shows how far one integration's OAuth tokens can travel across customer tenants.
- Remove what the attacker created: admin accounts, API keys, identity trusts, private application segments, custom URL categories, DLP exceptions and log destinations.
- Hunt downstream: review internal applications reached through private access, SaaS tenants touched by connector tokens and identity provider sign-ins from connector egress addresses.
Recovery and testing
- Staged return: restore steering to a pilot group first, confirm inspection, DLP and private access behave as the approved policy says, then widen.
- Rollback point: keep the pre-incident export and the rebuilt baseline in version control so a recovery change can be reverted without reintroducing attacker changes.
- Validation tests: test that known-bad destinations are blocked, that a disabled client loses private access, and that a test bypass change raises an alert in the SIEM.
- Close the residual window: keep watching for use of revoked tokens and old keys for at least the longest token lifetime in your estate, then confirm zero hits before closing.
Evidence to preserve and notification
| Evidence | Why |
|---|---|
| Admin audit log export with hashes | Timeline of who changed what; may expire in the service |
| Configuration exports before and after containment | Proves which bypasses and rules were attacker-made |
| Connector host disk and memory images | Initial access and lateral movement analysis |
| SaaS audit logs for connector identities | Scope of data read or changed, for notification decisions |
| Identity provider sign-in and trust change logs | Administrator compromise path and forged assertion checks |
| Provider correspondence and advisories | Third-party root cause and contractual follow-up |
If connector tokens read personal data, assess notification duties early: under GDPR Article 33 a personal data breach is notified to the supervisory authority within 72 hours of becoming aware, where it is likely to result in a risk to individuals. Sector and national rules vary; see the Cyber Incident Reporting Requirements Map. Where the provider was the source, notify according to your contract and ask for theirs.
Detection and measurement
- Configuration drift: scheduled diff of the live tenant against the approved export, alerting on any unexplained change.
- Connector identity use: SaaS-side alerts for CASB connector activity from outside documented egress addresses.
- Admin events: alerts on new admins, API keys, identity trust changes and log destination changes.
- Time from first suspect admin event to tenant lockdown, measured in exercises.
- Percentage of platform credentials in the rotation inventory with an owner and a tested rotation procedure.
- Age of the last approved configuration export (target: no older than your change cycle).
- Connector hosts rebuildable from a trusted image within a target time.
- Revoked credentials seen in use after rotation (target zero after the residual window).
Framework mapping
| Playbook phase | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Triage and scoping | RS.MA-02, RS.AN-03 | IR-4 |
| Containment of admin access and policy | RS.MI-01 | AC-2, AC-6, CM-6 |
| Credential and key rotation | RS.MI-02 | IA-5, SC-12 |
| Rebuild and recovery | RC.RP-02 | CP-10 |
| Log protection and evidence | PR.PS-04 | AU-9 |
| Provider coordination and reporting | RS.MA-01, GV.SC-07 | IR-6 |
NIST SP 800-61 Rev. 3 frames incident response as part of risk management under these CSF 2.0 functions.
Common failure patterns
- Rotating admin passwords only: the API connector grants, SCIM token and connector keys stay valid, so access survives.
- Revoking inside the CASB but not at the SaaS: the token is still accepted by the SaaS provider until it is revoked there or expires.
- Cleaning connector hosts in place: a reimaged service on a compromised host keeps any implant below it.
- Editing live policy instead of restoring a baseline: attacker changes hide among legitimate ones and survive.
- Forgetting the inspection CA: a CA that may have left the key store remains trusted by every managed device.
- Uncontrolled fail-open: inspection is switched off in a hurry with no compensating controls and no date to restore it.
Practitioner checklist
- Export and hash the admin audit log, configuration and connector inventory before making changes.
- Record the steering decision, its approver and its review date.
- Revoke console sessions and API keys, remove unknown admins and verify identity provider trust settings.
- Revert configuration to the last approved export and apply later changes one by one with approval.
- Revoke CASB connector grants at every SaaS provider and review SaaS audit logs for connector activity.
- Rebuild private access connector hosts from a trusted image and re-enrol with new keys.
- Rotate SCIM, log streaming, connector service account and identity trust credentials; replace the inspection CA if its key may have left.
- Monitor for revoked credentials for the longest token lifetime, then close with a post-incident review.
Standards and references
- NIST: SP 800-61 Rev. 3 Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- CISA: Supplemental Direction V1 to ED 24-01, Mitigate Ivanti Connect Secure and Ivanti Policy Secure
- IETF: RFC 7009 OAuth 2.0 Token Revocation
- IETF: RFC 9700 Best Current Practice for OAuth 2.0 Security
- Microsoft Learn: Revoke user access in Microsoft Entra ID
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
- NIST: Cybersecurity Framework 2.0
- MITRE ATT&CK: T1685 Disable or Modify Tools
Related NHI Mgmt Group resources: Securing the CASB and SSE platform itself · CASB Guide · Edge Device Compromise Investigation Playbook · Leaked Credential Response Playbook · If your enterprise browser is compromised