It wasn’t bad code. It wasn’t zero-day malware. It was a stale credential unchanged for months, tied to one person, with too much access. That breach cost millions — and it could have been prevented with two old but often-ignored principles: Password Rotation Policies and Separation of Duties.
Password Rotation Policies are not glamorous. But they are one of the most direct ways to contain damage. Credentials expire on a set schedule, forcing replacements before attackers can rely on them. Automated rotation closes the window of opportunity for anyone holding leaked or stolen passwords. Rotation shouldn’t be random or ad-hoc. It should be enforced, logged, and measurable. This is easier when applied across services with centralized control, so all team logins follow the same lifecycle.
Separation of Duties works in parallel. No single person, key, or account should have the power to do irreversible damage. By splitting roles and duties across multiple accounts or teams, you make it harder for a compromised identity to execute high-impact actions. In practice, this means ensuring privileged accounts are dedicated to specific, narrow functions, and that system changes require multiple approvals or identities.