Finance's scanner only speaks basic authentication — how do you decide what happens to that path?

## Why this is a decision and not a fix The technical answer takes one sentence: a path that cannot present a challenge cannot be made to require one. Everything after that sentence is organisational — what the path is worth to an adversary, what it costs the business to close, and who is entitled to make the trade. That is why this question separates a senior engineer from a lead. The senior answer is "disable basic authentication". The lead's answer includes what happens when a department with a statutory reporting deadline says no. ## Establish what the credential actually reaches Before arguing about the path, price it. A scanner that submits mail typically needs to **send** and nothing else. Yet these devices are very often configured with a person's account — frequently a long-serving finance manager's — because that was the fastest way to make it work on installation day. That detail is the whole risk. The credential is not "a scanner's password", it is a working credential for a person's mailbox on a path where no factor applies. To an operator whose business is reselling access, a mailbox is a product; a send-only submission identity with no readable contents is close to worthless. **Repricing the credential is usually a larger risk reduction than anything else available, and it needs no budget** — it is a configuration change on an identity nobody owns emotionally. ## The levers, in order of what they remove 1. **Retire the path.** Replace or reconfigure the device so it authenticates modernly, or route its output through a system that does. This removes the adversary's dependency rather than raising its price. It costs money and a project slot. 2. **Separate the identity.** Its own account, never a person's, so a leaked credential cannot open anyone's correspondence. 3. **Cut the rights to the minimum.** Send-only; no mailbox read; no directory access; no ability to change its own credential. 4. **Restrict the source.** Accept the credential only from the addresses the device genuinely uses. A credential that works from one subnet is worth far less to a broker than one that works from anywhere. 5. **Date the exception.** An end date with a named owner, not an entry in a register. Undated exceptions become permanent. Notice that steps 2 to 5 are all *control classes that do not require a prompt*. That is the general principle worth stating out loud: **when the missing control cannot be reinstated, substitute controls that remove what the attack depends on** — a readable mailbox, reachability from anywhere, an unbounded lifetime. ## Who decides Three parties have standing and they are frequently confused: - **The business owner** who depends on the device and controls the budget for replacing it. They can accept the residual and they can fund the fix; they cannot overrule a hard regulatory or contractual requirement. - **The platform owner** who runs the identity provider and carries the consequences of the path being open to everyone, not just finance. Their legitimate position is that a tenant-wide protocol allowance is not a per-department decision. - **The vendor**, if the device genuinely cannot be updated. The right response is a dated statement from them — either a firmware commitment or a written confirmation that none is coming, which converts a technical annoyance into a procurement fact and usually unlocks the budget. The engineer's job is to make the choice legible: here is the path, here is what the credential reaches today, here is what it reaches after the free changes, here is what closing it costs and when. Then hand the decision to whoever owns the money. ## Sequencing under a deadline A good answer explicitly refuses both failure modes. Do not block the protocol tenant-wide the week before a close — an outage you caused is a real cost and it burns the credibility you need for the next argument. Do not accept the exception unchanged either, because the cheap changes are available today and shrink the loss by an order of magnitude. The defensible sequence is: reprice the credential this week at no cost; scope the protocol allowance to that one identity and source rather than the tenant; agree a dated replacement with the owner who funds it; block the protocol everywhere else immediately. **The exception should end up narrower than the department asked for and longer-lived than you wanted, and both of those are the point of negotiating rather than decreeing.**