Exercise 3: Why Skipping Your Own Credential Hygiene Is "Protecting the Wrong Side" — Possible Solution ==================================================================== WHAT THE INCONSISTENCY LOOKS LIKE ------------------------------ A technician who strictly enforces Chapter 5's rules on end users - full verification before a reset, no plaintext credentials, no "temporary" MFA bypasses - while personally reusing passwords, skipping MFA on their own accounts, or writing credentials down, is applying a security standard asymmetrically: rigorous for the people they support, lax for themselves. WHY THIS MATTERS GIVEN CHAPTER 9's OWN REASONING ------------------------------ Per this chapter, a support workstation is a "pivot point" precisely because it can reach many other accounts and systems at once. That means the technician's own account security isn't a personal, low-stakes matter the way it might be for a regular employee - a compromise of the technician's own credentials has the exact same pivot-point consequence Exercise 1 already established, regardless of how well the technician protects everyone else's accounts. WHY IT'S "THE WRONG SIDE," SPECIFICALLY ------------------------------ The whole point of Chapter 5's procedure is to prevent an attacker from reaching an account through weak verification or poor credential handling. If the technician's own account is the weak link, an attacker doesn't need to defeat any of that carefully-enforced process at all - they can go around it entirely by compromising the person enforcing it. Protecting end-user accounts rigorously while leaving the technician's own account exposed protects the part of the system that was already less likely to be the actual point of failure, while neglecting the part - per Chapter 9's own reasoning - most likely to cause the widest damage if compromised. WHY CONSISTENCY ACTUALLY MATTERS, NOT JUST FAIRNESS ------------------------------ This isn't a matter of the technician deserving the same protection "fairly" - it's that the entire chain of security this course has built (Chapters 2 through 9) only holds together if every link, including the technician's own account, meets the same standard. One neglected, high-value link undermines the whole chain regardless of how strong the rest of it is. WHY THIS WORKS AS AN ANSWER ------------------------------ It describes the specific inconsistency, connects it back to Chapter 9's own pivot-point reasoning about why the technician's account matters more, not less, and explains why an attacker would simply route around a rigorously-enforced process by targeting its enforcer instead.