Last year's visitor is still here
A backdoor account left behind back then was still there more than a year later.
(Illustrative scenario, not a real incident)
That day wasn't over yet.
We had another cloud key,also within the leaked scope,still valid right up to that morning.
We went through the logs entry by entryand confirmed that during that timeno data had been read or changed.
By rights, we could have called it a day.
But that account had a record:the trip in No. 1.Since we were already in,we might as well check whether that story had really ended.
It hadn't.
The machine that spawned administrators was deleted long ago.But the user it created back thenwas still there.For more than a year, it had kept its permission to send email.
Back then we removed its administrator rightsand disabled its keys,and it looked as if it could do nothing.But we never deleted it.
What we cleared was its “ability,”not its “identity.”An identity that still existscan be given abilities again at any time.
Laozi said: “Be as careful at the end as at the beginning, and nothing will fail.”The last step deserves the same care as the first.
I used to think security was a race of speed.Later I learnedhackers don't play by “fast.”
Zhuangzi told of a wooden rooster.By the end of its training, it looked as if carved from wood,and other roosters took one look and fled.The winner wasn't the fastest one,but the steadiest.
Deleting a function is not deleting an identity.Moving a location is not changing a key.Finishing the work is not the end of the matter.
After handling an incident, list every user, role, and key created during that period. Don't just strip permissions; delete the identities you no longer need.