Former Cisco engineer pleads guilty to causing Webex account chaos
zdnet.com
zdnet.com
At most companies IT handles logins and credentials for all internal systems. Things like email, vpn, internal sites, and chat. Usually this is all centralized, and when someone leaves IT revokes that user's access to everything.
I'm guessing what happened here was that the engineer got access to AWS manually. Maybe IT wasn't responsible for handling AWS credentials and it was expected that the person who gave him access would revoke it too. Alternatively, the person who gave him might not have gone through the company's regular policies.
Either way, the process in place for handling credentials here clearly didn't work and they got burned in it. Would love to see the internal postmortem here.
For this, in general, the answer is: (1) yes, IAM permissions, and (2) yes, if you configure them, and they often have a cost.
> Wouldn't AWS step in and help a company like Cisco if something horrible went wrong?
If Cisco asked, probably. But some things are inherently non-trivial to recover from once you've allowed them to happen. AWS can help, but they aren't magic.
Remove the user that is being terminated from the group and 'voila', it is safe.
Well, not accidentally, but the flag itself can be cleared programmatically, so protected instances can definitely still be maliciously deleted programmatically, if the actor has sufficient access.
I read this as incompetence on Cisco’s part.
This demonstrates Cisco is shockingly incompetent. Imagine if, instead of basically causing them a business hassle, this engineer decided to grab the list of sales contacts for companies -- easily available by looking at who salespeople are meeting with -- and sell those?
It's cisco's job to make this impossible in more robust ways than hoping every employee they have is a good person.
Cisco are also liars, because they've almost certainly made commitments in SOC2 or 27001 or other audits that this is impossible via policy and procedures. And yet.