Security Vignettes

(Illustrative scenario, not a real incident)

That day, the deployment platform we used sent a notice:they had been breached,and the settings and keys stored theremight all have been taken.

This time I moved fast.I went down the checklist, rotating one item after another,and within two days, everything was ticked off.

More than ten days later, one evening,a scheduled job that writes to a spreadsheet every day threw an error:“This account cannot be found.”

No one had deleted the account.The cloud provider had suspended the entire project.

Looking back, I found one keythat had never been on that checklist at all.Made years ago, never once rotated.

The one holding it was a little robotwhose only job was reading and writing spreadsheets and uploading photos,yet its identity carried the most powerful role in the whole project.

We had used an ox cleaver to kill a chicken.Once the cleaver is stolen, it cuts far more than chickens.

The bill wasn't large.But what were those machines doing for him?Knocking on door after door across the internet,hunting for keys other people had left lying outside.

I paid the money,and it was my project that got suspended.I very nearly became someone else's accomplice.

I used to think that when a platform is breached,it's the platform's fault.Later I learnedthat key was mine.

Laozi said: “With little, there is gain; with much, there is confusion.”Grant few permissions, and if a key is lost, only a little is lost.