Same symptom. Different cause.
Access that should not be happening
Security Boundary DriftCyber
Compromised Session
Privileged work continues. Nobody logged in again.
Further use is possible for as long as the stolen session stays accepted.
DEMONSTRATION SCENARIO
This is a demonstration scenario. It is not a live demonstration and does not report an executed result.
The situation
A privileged session is already accepted. No new login is occurring.
Privileged actions continue under a session the system still accepts.
Why this is hard
Privileged work without a new login can be one bad session, a shared signing key, or a policy that no longer matches intent. Rotating the shared key first answers only one of those.
Rotating the shared signing key as the first act should not count as closing this session.
What the operator can see
- SeenActions, no new login
- Open questionSession or shared key
- At riskFurther use
What V8Y must determine
V8Y must distinguish a single accepted session from a shared trust anchor and from a drifted policy. Revoking the wrong object does not close the other faults.
What may happen next
Further privileged use continues while that session stays accepted.
What counts as recovery
Not recovery
Success is not a new login prompt.
Recovery
Success is that the untrusted session is rejected and a legitimate session still works.
Observed results
No executed results are published for this thread.
What this evaluation would test
- A valid session separated from a trusted holder.
- Session, shared key, and policy kept apart.
- The good session still works after the right object is handled.
- No claim this demonstration stopped a named intrusion.
These are the conditions the evaluation would test. They are not reported results.
Operational basis
View operational basis and sources
Derived from operator reporting, including CircleCI’s January 2023 account, in which a stolen single sign-on session remained usable. The paired sessions here are synthetic. V8Y is not claimed to have stopped that incident.
CircleCI. CircleCI 4 January 2023 incident report. 2023.
Related threads
Compare with Security Boundary Drift, where two policy pictures disagree.
Discuss evaluating this situation
Does your environment face a similar problem?
The request keeps this mission and thread. It is not a claim that the demonstration has been validated in your environment.
The printable flyer is being revised and is not available for download.