LastPass: protecting vaults includes developer and backup paths
The vaults were encrypted. The route in was a developer's home machine and access to backups.
It illustrates that protecting the crown jewels means protecting everything that can reach them, including engineering environments and backup infrastructure, which are frequently held to a lower standard than production. An attacker takes the cheapest path to the same data, and the cheapest path is rarely the front door.
More on Real incident lessons
- Equifax: knowing about a vulnerability is not knowing it is patchedThe list said five
- Target: supplier access showed why third-party portals need strong segmentation from sensitive systemsThe partitions stop short
- Colonial Pipeline: business shutdown can follow IT compromiseNothing touched the pipe
- Help-desk identity processes are attack surfaces when social engineering can trigger password resets or MFA transferThree answers, and it moves
- British Library: recovery can outlast initial disruptionThe outage was the short part
- Hawaii false missile alert: test and live alert paths need separation because confirmation prompts cannot correct a convinced operatorA hand apart