The credentials were real, the computer wasn’t
The credentials were real, but the computer logging in wasn’t the company’s.
(Illustrative scenario, not a real incident)
This forty-person accounting firmhad done its homework.Every system was connected to single sign-on,and two-step verification was mandatory.
But one colleague’s computerwas infected with an infostealer.The login sessions in the browser were stolen.
With those sessions in hand,the attacker, from another computer,opened client reports in the cloud drive.
The system didn’t block anything.As far as it knew,this was a colleague who had already been verified.
I used to think confirming “who you are”was enough.Later I learnedyou also have to ask:“Which computer are you using?”
Computers that are unpatched, unencrypted,with antivirus switched off,can log in all the same.And IT doesn’t knowwhich devices are touching company data.
Zhuangzi said: “A name is but the guest of reality.”The name is only a visitor to what is real.
The account is the name.The machine sitting in front of the screenis the reality.
Check the device as well as the identity: only registered, up-to-date, encrypted company computers may access client data.