5.5 How Small Mistakes Lead to Big Incidents
Link One: The Weak Credential
Enterprise breaches routinely begin with a logon attempt, not an exploit. Password spraying -- a handful of common patterns tried against every account at once -- works precisely because lockout logic counts failures per account, not per password. Legacy endpoints that cannot take multi-factor authentication, such as basic-auth webmail, SMTP relays, and older VPN appliances, are the preferred doors. The spray needs exactly one match, and every organization has one: a shared service login, a contractor account, a supplier still using the password from 2019. No malware, no zero-day, no alert.
Link Two: The Exposed Dev Endpoint
That low-privilege foothold then gets pointed at development and staging, the usual next link, because non-production is optimized for velocity, not hardening. Staging subdomains skip the external-scanner allow-list and happily serve debug endpoints and API documentation; repositories hardcode staging database strings and API tokens that get reused verbatim in production; shared identity providers mean the staging login page speaks the same directory language as the corporate one. GitHub-crawling bots and certificate-transparency watchers harvest these exposures continuously, so an exposed dev endpoint is collected, not discovered.
Link Three: Staging as Pivot
Once on a staging host, "non-production is isolated" collapses: service accounts in configuration files frequently hold production connectivity, CI runners are over-privileged by design, and non-production servers are commonly excluded from EDR coverage and log forwarding. Credential harvesting from configs, memory, and browser profiles, followed by Kerberoasting and pass-the-hash across a flat internal network, converts a staging box into directory access. From there the path is textbook: escalate to domain administration, then deploy the payload -- encryption, or a quiet export of customer records.
Breaking the Chain
Each link only has to fail once, and usually in order, so defense should be chain-shaped: require phishing-resistant MFA on every authentication path including legacy ones, scan externally for every dev subdomain, treat non-production as production for secrets and telemetry, and segment so staging cannot reach domain controllers at all. A post-incident review that stops at "a user clicked a link" has missed the point -- walk the chain back to the stale credential or exposed endpoint that started it, because that is where the durable fix lives.
Architecture Diagram
Key Takeaways
- Password spraying beats per-account lockout by design -- spray legacy endpoints and shared accounts first.
- Exposed dev endpoints are pre-harvested by bots: put every dev subdomain in external scanning.
- Non-production commonly shares directory auth, prod-scoped secrets, and missing EDR -- treat it as production.
- Lateral movement thrives on flat networks: segment staging away from domain controllers by default.
- Do post-mortems chain-shaped: fix the first failed link, not just the last one.