Who Goes There, and What Are They Allowed to Do?

The alert came in at 11:40pm, which meant nobody saw it until morning: a successful login to a teaching-assistant account, from a city none of CyberAI Hub's actual teaching assistants lived anywhere near. The account itself was low-privilege, limited to grading quizzes for one course. Nobody had flagged it as urgent.

"Low privilege doesn't mean low interesting," Meher ma'am said, pulling the login history. "Let's find out how they got in before we decide how much it matters."

It took less than an hour to find the answer, and it was almost disappointingly simple: the teaching assistant had reused the exact same email and password combination on a different website, one that had suffered its own, unrelated data breach eight months earlier. An attacker running a credential stuffing attack, trying millions of leaked email-password pairs against popular login pages, had simply gotten lucky on CyberAI Hub's.

"No MFA on TA accounts yet," Mahika noted, checking the account settings. "And the password reset flow doesn't ask for anything besides the email address, no second check at all."

"Two separate gaps," said Meher ma'am. "A password that was never unique to begin with, and nothing behind it to catch a login that shouldn't have worked even with the right password."

The attacker's session lasted under ten minutes before an automatic timeout ended it, long enough to browse the grading dashboard for one course, and nothing else. No grades were changed. No data was exported. It looked, on the surface, like almost nothing had happened.

"Almost nothing happened this time," Meher ma'am said. "Which tells us the lock on the door was flimsy, not that there was nothing worth stealing behind it. Fix the door anyway."

Days later, fixing MFA for the TA accounts led Mahika into reviewing a different, unrelated pull request: Shruti's first solo feature, a "view my grading history" page for teaching assistants. The code worked. Mahika tried it in a test environment anyway, logged in as one TA account, and, almost as an afterthought, changed a number in the page's URL from her own TA ID to a different one.

The other TA's grading history loaded instantly. No error. No permission check. Nothing.

"Oh no," Shruti said, when Mahika showed her. "It checks that you're logged in. It just never checks that you're logged in as you, specifically, for this one record."

"This is the exact distinction I keep coming back to," Mahika said, half to Shruti and half to herself. "Authentication answered 'is this really a TA logged in.' It did, technically, correctly, that part worked. Authorization has to separately answer 'is this TA allowed to see this specific record.' Nobody ever asked that second question on this page."

Shruti's fix, once she saw it, took under twenty minutes: before returning any TA's grading history, the server now checks that the requested TA ID matches the ID of whoever is actually logged in. Same login system. One new check.

"This is going to be the thing I check on literally everything from now on, isn't it," Shruti said, not quite a question.

"Welcome to security," said Mahika, who'd asked the exact same thing about Book 2's own group project repo, almost exactly a year earlier.