>allowing passwords to hit the logging infrastructure.

This is the most ridiculous of the three in my opinion. When logging to elasticsearch you programmatically have to say what data to put in the document before its indexed (and thus viewable via Kibana). This means that the developer actually put the password as a parameter in the document object.

If you cut corners in management then you are directly responsible for the cock-up, period.

This is a modern issue with the way laws look at subcontracting work as a tool that allows companies to isolate themselves from liability which needs to change, if your company (Elsevier) sub-contracts it should be your company on the line - with an allowance to pursue legal action against the sub-contractors that will be examined in depth during that proceeding.

These sorts of situations have too often resolved in "Well, we can't tell if it was the parent or sub-contractor that was responsible, I guess we need to let them both off." instead hit the parent with the full force of the law as a negligent reseller and if they were unaware of these situations they can recoup their costs by pursuing the subcontractor on their own dime.

If you decision leads to a failure like this, you are directly responsible. Responsibility for business processes are not outsourced with the IT service. When a company that has huge guaranteed profits (by nature of the academic publishing "market"-structure), and no IT skills to verify network service providers, you are responsible for not having any oversight to the processes of your company.

Sorry but this type of issue often occur because developers has your mindset. I've had so many auditors and security reviewers ask me "how do you hash your password?" but no one has asked me if I log http request, session tokens, outbound emails or any other thing where sensitive data can be transmitted. Nor have they asked me what the actual process for rotating credentials when employees leave, more than "Do you do it?"

I recently used a website to sign up for online Health insurance access and noticed they console.log your password back to you in clear text whenever you hit submit. Now maybe 99% of the population won't know what to do with that, but despite the fact that someone's debug log for passwords made it into production which tells me all I need to know about their standards, what if they are using something like rollbar, fullstory, or god knows what else that captures log output? What about malicious browser extensions? I called their technical support helpline, and I got the typical joke of a "oh that's not my department" response. Imagine what they are doing with our healthcare data.