> "They violated our password policies and they posted that password on an internal, on their own private Github account," Thompson said.
So let's analyze the various scenarios under which the "intern" might have been responsible, and why each one is bullshit.
1) The intern exposed a company password on their own account.
Counter: What kind of "password policies" allowed such a weak password in the first place?
2) The intern came up with the weak password themselves, thus violating "password policies" not just for secrecy but strength/security. This password was then used for several critical, production applications.
Counter: Why was an intern in charge of deciding a password used for anything critical?
3) The intern came up with the weak password and exposed it, but it was only used for the intern's own corporate accounts (e.g. their Windows workstation).
Counter: Why did an intern have a level of access such that their account being breached could lead to this level of compromise/exfiltration?
Conclusion:
There is no conceivable scenario under which this makes sense.
So let's analyze the various scenarios under which the "intern" might have been responsible, and why each one is bullshit.
1) The intern exposed a company password on their own account.
Counter: What kind of "password policies" allowed such a weak password in the first place?
2) The intern came up with the weak password themselves, thus violating "password policies" not just for secrecy but strength/security. This password was then used for several critical, production applications.
Counter: Why was an intern in charge of deciding a password used for anything critical?
3) The intern came up with the weak password and exposed it, but it was only used for the intern's own corporate accounts (e.g. their Windows workstation).
Counter: Why did an intern have a level of access such that their account being breached could lead to this level of compromise/exfiltration?
Conclusion: There is no conceivable scenario under which this makes sense.