Tuesday delivered three reminders that one good control can’t carry you.

By lunchtime, a researcher had dropped proof-of-concept code that bypasses BitLocker on unpatched Windows machines. Exim, the mail transfer agent running a huge share of the internet’s mail, picked up a fresh remote code execution flaw. And West Pharmaceutical Services, a contract manufacturer for some of the largest drug companies on the planet, told regulators that attackers stole its data and encrypted its systems. Different attack surfaces, different vectors, same lesson about cybersecurity posture: every layer is one bad day away from being the one that fails.

That’s when defense in depth stops being a slide and starts being the only thing between you and the breach notification you’d rather not write.

Three Layers Cracked at Once

The BitLocker bypass, nicknamed YellowKey by its discoverer, sits next to a privilege escalation flaw called GreenPlasma. Both have public proof-of-concept exploits. Both are unpatched. If you’ve been treating full-disk encryption as the answer to “what if a laptop walks off,” that assumption needs a footnote now. A motivated attacker with brief physical access can extract data from a stolen device. Working code is already public, sitting in a GitHub repo.

Exim’s vulnerability hits closer to the perimeter. Certain configurations of the open-source mail server allow an unauthenticated remote attacker to run arbitrary code. Exim runs on a huge slice of internet-facing mail servers. If yours is one of them and the firewall in front of it doesn’t restrict who can talk to port 25, you’re a scan away from a problem.

West Pharmaceutical’s disclosure is the operational story. Attackers exfiltrated data and encrypted systems. Pharma manufacturing has been a quiet but consistent ransomware target for two years now, and double-extortion playbooks aren’t asking permission anymore. The interesting question is what failed first.

Defense in Depth or Excuses in a Row

Every breach postmortem looks like a domino chain. A phishing email lands. A weak password gets brute-force tested in the background. A credential lets someone into a VPN. Lateral movement starts. Backups get touched. Encryption happens. By then, your incident response team is reading logs that should have screamed three days earlier.

The point of defense in depth is that one failure shouldn’t end the story. The BitLocker PoC matters less if the device has device-bound credentials and a working remote wipe. The Exim flaw matters less if mail servers can’t reach finance systems and outbound egress is policed. The West Pharma encryption matters less if backups are immutable and segmented from production credentials.

You don’t get to pick which control fails this quarter. You only get to pick how many you have stacked.

What to Do This Week

The patch lists are easy. The harder work is the layering.

• Audit your Exim deployments and apply vendor patches the moment they land. Until then, restrict SMTP source IPs at the firewall and watch for outbound connections from mail servers to anywhere they have no business talking to.
• Treat the BitLocker PoC as a forcing function for endpoint hardening: enforce TPM-bound encryption with pre-boot authentication, disable boot from external media, and verify your asset inventory knows which laptops are encrypted and how.
• Pull out your ransomware playbook and time the runbook for the case where backups are also encrypted. If recovery depends on a single backup target reachable from a domain admin account, attackers will hit it on day one.
• Tune threat detection around the seams between layers: a successful login from an unusual endpoint, a mail server initiating SMB, an admin account touching a backup volume. The signal lives in the unusual transition.

Run brute-force protection on every authentication surface that faces the internet, including SMTP AUTH and any management interfaces. Rate limits and lockouts are crude. They also keep working when fancier threat-protection tooling is dialing into a vendor outage.

Map your incident response chain end to end and stress test the boring parts. The communication tree. The legal contact list. The press statement template. West Pharmaceutical is a publicly traded company with regulators watching. The next twelve months will be lawyers and forensics retainers, not engineers writing detections.

The cyber security maturity gap shows up in moments exactly like this one. Three unrelated stories, three unrelated controls, one underlying truth: the org that wins this week is the one that already assumed each layer might fail.

Security hardening is boring. So is owning the breach.

Sources

• West Pharmaceutical says hackers stole data, encrypted systems
• New critical Exim mailer flaw allows remote code execution
• Windows BitLocker zero-day gives access to protected drives, PoC released