(A fictional story where imagination meets the real world)
It didn’t begin with a sophisticated exploit.
There was no zero-day vulnerability, no human factor exploited, and no dramatic breach of a cutting-edge security system.
It began with a test server.
Because it was “only temporary,” it wasn’t included in the regular patching process. The XDR agent was never installed either. It wasn’t monitored by the security team, and no one had formally taken ownership of it. Over time, everyone assumed someone else was responsible. Eventually, everyone forgot it was there.
One evening, an admin noticed an unusual VPN access on its central console. Alerted, he began investigating. An uneasy feeling began growing among the team.
Two nights later, backups began disappearing as the admin in charge was actively working on them. Bad timing, or luck? Alarmed, he called whoever was reachable: disconnect the VPN service, unplug the internet, shutdown VMware console, close the lights.
But it was already too late: the attacker was already inside, ready to perform. She had likely spent days, perhaps months, quietly exploring the environment, mapping the network, tracing user accounts and connected systems. Eventually, she obtained privileged credentials. Domain admin she was. Critical systems were compromised, backups were deleted, and ransomware began spreading across Windows servers. And just as she moved to execute the final move, a tech guy working late that same night noticed something strange, an unusual activity: deleted backups, and raised the alarm. Several colleagues soon joined him…
VPN access was cut first. Internet second. VMware was unplugged by morning. Everybody, humans and systems, was isolated inside a building (or two). And then what?
Sleepless nights, restless minds… system admins didn’t know how to begin. After an attacker had gained such extensive privileges, what could still be trusted? So they did the unimaginable: they rebuilt everything from scratch. And because they never wanted a repeat, everything was built with security as the highest priority. It took two weeks for the admins to sleep properly again, and four weeks for the systems to be rebuilt.
Plans came later: a disaster recovery plan, a crisis management plan, an incident response procedure. Too late? Perhaps. But better late than never, and built from hard-won experience.
The forgotten server became a Trojan horse into the organisation’s infrastructure. A system that no longer served any business purpose. Not because the organisation lacked security technologies. Not because the vulnerability was unknown. Not because the attacker used advanced techniques. But because a forgotten system was there, and nobody was responsible for.
The lesson is not simply to patch servers. It is mainly to treat every single server as untrusted. The first step in deploying a server: install the XDR agent. Log push. Document the server and its owner. Monitor. Secure every asset that connects to the network, whatever its purpose.
Cybersecurity often depends on ordinary operational discipline and taking the extra step. Every temporary system needs an owner. Every asset needs to be inventoried. Every server needs to be monitored, updated, and decommissioned when it no longer serves a purpose. And all infrastructure should be checked, audited and monitored, constantly.
Most cyber incidents do not begin with extraordinary events. They begin with ordinary actions, or ordinary omissions. A forgotten test server, a postponed software update, a reused password, an XDR agent that was never installed, or an unreported phishing email may each seem insignificant on their own. Yet each can become the first step in a chain of events leading to a major cyberattack.
Building a resilient organisation is not only about deploying advanced security solutions. It is also about consistently getting the small things right.
Environments change. People change. Systems change. New servers appear, old ones are forgotten, exceptions become permanent, and yesterday’s secure configuration may become tomorrow’s vulnerability. Consistency, and attention to the small things is what stands between an ordinary Tuesday and a very long month.
About the author
Her current work focuses mainly on cybersecurity, including security operations (SecOps), governance, risk and compliance (GRC), and the implementation and improvement of security controls. She is involved in identifying and addressing security issues, supporting day-to-day security operations, and helping ensure that security practices are aligned with organizational requirements and policies.
She holds a Master’s degree in Cybersecurity and has built extensive hands-on experience throughout her career in IT. Having worked across different areas of IT throughout her career, she has developed a practical understanding of both the technical and organizational aspects of cybersecurity. Her experience allows her to approach security from both an operational and governance perspective, with an emphasis on practical solutions, effective security practices, and continuous improvement.
