Change management and the four-eyes rule

Graduate · enrolled learners

This lesson opens with Ledger Connect Kit supply-chain compromise, December 2023.

What happened

On 14 December 2023 an attacker phished a former Ledger employee whose npm publishing access had never been revoked, obtained that credential, and published malicious versions of Ledger's Connect Kit, a small JavaScript library that thousands of decentralized applications loaded from a public CDN to let users connect their wallets. The malicious versions carried a wallet drainer: any user who connected a wallet on a site pulling the poisoned library could be prompted into transactions that emptied it. Because the library was distributed by content delivery network, the bad version propagated to every site using it within minutes, and roughly 600,000 dollars was drained in the few hours before Ledger detected the swap and pushed a clean version. The technical vulnerability was ordinary phishing, but the reason a single phished credential could ship code to thousands of applications was the absence of change management: one account could publish to production with no independent second reviewer approving the release, and that account still belonged to someone who had left.

The decision point

A production system is only as controlled as the process for changing it, and a change is any new version of code, configuration, dependency, or access that goes live. Change management is the discipline that no such change ships on a single person's authority: the core control is the four-eyes rule, that a second independent person reviews and approves a change before it reaches production, so that one compromised or malicious actor cannot ship alone. Ledger's Connect Kit failed at exactly this point, one phished credential published to thousands of applications with no second set of eyes on the release, and the failure compounded because the credential belonged to a former employee whose access had never been revoked, which is the access half of the same discipline. The decision is to treat every path that can change production, an npm publish as much as a database migration, as a change that requires an independent approval and an access list that is revoked the day someone leaves, because a change that one person can ship alone is a change one compromised person can ship alone.

Recorded loss

$600,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.