防暴筆記BREACH NOTES

Security Vignettes

Breach Notes｜43 stories

分享

The clever learn from their own mistakes.The wise are inspired by the mistakes of others.

Every story here is an illustrative scenario.People, companies and details are adapted or invented;any resemblance is coincidental.

Read in order

  1. 1“The robot seems to have crashed”Three days abroad, one routine notification email, and a trail that led me to a backdoor in a region I had never used.Inventory & awareness
  2. 2Using an ox cleaver to kill a chickenA platform announces a breach, and a key unchanged for years turns up inside a little robot with every permission switched on.Keys & permissions
  3. 3“Is anyone changing something?”The site suddenly stopped taking bookings, and what I found was a script, not a person.Inventory & awareness
  4. 4The silent organA machine no one was watching quietly mined crypto for someone else for nearly a year.Inventory & awareness
  5. 5A spare card unused for a yearAn AI key untouched for a year ran up a frightening bill in a single day.Keys & permissions
  6. 6The calm before the stormA key we knew was high-risk but put off revoking because it was a hassle was abused just over a month later.Keys & permissions
  7. 7Last year's visitor is still hereA backdoor account left behind back then was still there more than a year later.Offboarding & accounts
  8. 8The great way is simple: five habits for tomorrowThe great way is simple: five good habits to carry into tomorrow.Inventory & awareness
  9. 9The tools beneath the icebergAn inventory revealed that the tools IT knew about were only the tip of the iceberg.Inventory & awareness
  10. 10The monthly fee nobody claimedA small monthly fee nobody claimed turned out to be an orphaned account.Offboarding & accounts
  11. 11The person left, the seat stayedSomeone left the company, but the paid seat and the side door stayed open.Offboarding & accounts
  12. 12The door is shut, the window is openThe single sign-on door was shut, but the window beside it was still open.Offboarding & accounts
  13. 13The first day, waiting for accountsNew hires wait for accounts; people who change roles only ever gain access, never lose it.Offboarding & accounts
  14. 14A single “OK”One “OK” in a group chat, and temporary access became permanent.Keys & permissions
  15. 15One click on “Allow”One click on “Allow,” and a little AI tool had the keys.AI & agents
  16. 16Three tools doing the same jobThree tools doing the same job: three bills, and three sets of doors to close.Inventory & awareness
  17. 17A hundred seats, sixty peopleA hundred seats paid for, and over thirty accounts nobody uses.Inventory & awareness
  18. 18The rubber-stamp reviewAn access review where managers can only rubber-stamp, and the list still includes people who left.Keys & permissions
  19. 19The laptop is still at his placeThe accounts were revoked, but the laptop is still at a former colleague's home.Offboarding & accounts
  20. 20Only at month's end do you know what burnedWith usage-billed AI, you only learn how much burned at the end of the month.AI & agents
  21. 21No names on the billAll you can see is the total, not which key is doing the spending.Keys & permissions
  22. 22The password is on her phoneThe domain’s verification code goes to a former colleague’s phone.Offboarding & accounts
  23. 23Just one digit apartSomeone else’s website leaked, and the password was one digit off.Passwords & sign-in
  24. 24Everyone knows, and still reusesEveryone knows not to reuse passwords. They reuse them anyway.Passwords & sign-in
  25. 25If you can’t stop it, at least make it strongYou can’t stop staff from signing up on their own, but you can make sure the passwords are strong.Passwords & sign-in
  26. 26The email that was one letter offThe URL was one letter off, and the verification code was stolen too.Passwords & sign-in
  27. 27“I was asleep at the time”A sign-in in the small hours, and the logs are scattered and already expired.Inventory & awareness
  28. 28That one change from two years agoThe key was deleted, but the version history remembers everything.Keys & permissions
  29. 29The keys in the home directoryPlaintext keys on an engineer’s laptop, carried off in one go by an infostealer.Keys & permissions
  30. 30The one that never expiresThe admin key in the deployment pipeline that never expires.Keys & permissions
  31. 31One key, six places to changeChanging one key meant changing six places, so it never got changed.Keys & permissions
  32. 32The key the AI assistant sawA key pasted into an AI chat traveled far along with a share link.AI & agents
  33. 33“Just get it running first”The “just get it running first” AI agent held the keys to the entire database.AI & agents
  34. 34The key handed over during a fireAdmin rights granted during an emergency three years ago were never taken back.Keys & permissions
  35. 35Said it would read, but it wroteAn AI agent meant only to read data was tricked by a note into changing it.AI & agents
  36. 36The credentials were real, the computer wasn’tThe credentials were real, but the computer logging in wasn’t the company’s.Devices & contractors
  37. 37The contractor’s laptopA contractor’s personal laptop was infected, and private repositories were copied.Devices & contractors
  38. 38The seller console doesn’t check the computerThe console that earns the most money could be logged into from any computer.Devices & contractors
  39. 39The AI that moved into our computersAI tools moved into our computers, and IT can’t tell who installed what.AI & agents
  40. 40One spreadsheet, twelve clients’ keysOne shared spreadsheet held the keys to twelve clients.Devices & contractors
  41. 41The spare keys kept at someone else’s houseA cloud platform was breached, and every spare key stored there was dug out.Keys & permissions
  42. 42The city deleted by mistakeAn intern deleted the wrong cluster, and the backups had never been turned on.Keys & permissions
  43. 43Just asking whether it’s thereHe only wanted to know if a variable existed; every secret got dumped into the AI chat.AI & agents

Read by topic

Keys & permissions13

Offboarding & accounts7

Passwords & sign-in4

AI & agents7

Devices & contractors4

Inventory & awareness8