During a post-incident analysis, an investigator discovers that a compromised system was covered by a comprehensive, centrally approved password rotation policy, yet the attacker successfully utilized an administrative credential compromised over a year ago. Which statement best explains this discrepancy?
Pick A–D or press 1–4, then give this panel ten seconds: the verdict, and why each of the four options is right or wrong.
This scenario illustrates the fallacy of equating documented policies with actual operational effectiveness. A policy relies on technical enforcement and validation. Since a year-old credential still worked, the policy was not effectively enforced. Distribution failures, incident response delays, specific missing guidelines, or cryptographic hash functions do not explain the core failure of assuming documentation guarantees proactive security without proper technical enforcement.
- AHash strength is a separate issue; the credential worked because rotation was never actually enforced.
- BCorrect: a year-old credential still worked, so rotation was written down but not enforced; a policy on paper does not prove an effective control.
- CThe credential was compromised a year earlier; the gap is in prevention, not in how fast responders isolated it.
- DEven with distribution, the core failure is the lack of technical enforcement and verification of the policy.
More below: why each option is right or wrong — scroll this panel