PowerSchool：录入 vs. 执行
1 分•作者: Olsberg•5 个月前
大多数关于 PowerSchool 事件的讨论都将其描述为支持账户被入侵。<p>如果查看系统内部的操作链，大致如下：<p>入口：被入侵的支持凭证
执行：通过 PowerSource 支持门户进行的维护远程支持操作
记录系统：学生信息系统 (SIS) 数据库<p>该支持账户并未直接访问客户数据。<p>相反，操作是通过 PowerSource 支持界面执行的，该界面可以触发对客户数据库的操作。<p>实际上，支持门户充当了对生产数据库执行操作的执行机制。<p>这使得该事件与其说是直接访问数据库，不如说是与支持界面中嵌入的执行权限有关。
查看原文
Most discussions of the PowerSchool incident describe it as a compromise of a support account.<p>If you look at the chain of operations inside the system, it appears roughly like this:<p>Entry: compromised support credential
Execution: Maintenance Remote Support operations through the PowerSource support portal
System of record: Student Information System (SIS) databases<p>The support account did not access customer data directly.<p>Instead, operations were executed through the PowerSource support interface, which could trigger actions against customer databases.<p>In effect, the support portal functioned as an execution mechanism for operations on production databases.<p>This makes the incident less about direct database access and more about the execution authority embedded in the support interface.