The seller console doesn’t check the computer
The console that earns the most money could be logged into from any computer.
(Illustrative scenario, not a real incident)
This twenty-five-person online appliance shophad long since set up its email and documentsso only company computers could open them.
But the most important one of all,the seller console on the e-commerce marketplace,didn’t support single sign-on.It relied only on a username, a password, and an SMS code.
One customer-service agent, at home,on a personal computer that hadn’t been updated in ages,logged into the seller console to handle orders.
That computer hid an infostealer.The username, the password, and the login sessionwere all stolen.
The system that earned the mostwas the one least protected.
With the credentials,a personal computer, an internet-café computer—any of them could get in.Many people shared the same login,and the console’s login records were bare-bones.
I used to think that once the policy was set,it covered the whole company.Later I learneda policy covers only what it can see.
It is darkest under the lamp,and often darkest in the corner that matters most.
First list the consoles that aren’t on single sign-on but matter to revenue. Require that they be accessed only from company computers, with one account per person, never shared.