PowerSchool：录入与执行
大多数关于PowerSchool事件的讨论将其描述为一个支持账户的泄露。
如果我们查看系统内部的操作链，情况大致如下：
入口：被泄露的支持凭证
执行：通过PowerSource支持门户进行维护远程支持操作
记录系统：学生信息系统（SIS）数据库
该支持账户并未直接访问客户数据。
相反，操作是通过PowerSource支持界面执行的，这可能会对客户数据库触发操作。
实际上，支持门户充当了对生产数据库进行操作的执行机制。
这使得该事件更侧重于支持界面中嵌入的执行权限，而不是直接的数据库访问。
查看原文
Most discussions of the PowerSchool incident describe it as a compromise of a support account.<p>If you look at the chain of operations inside the system, it appears roughly like this:<p>Entry: compromised support credential
Execution: Maintenance Remote Support operations through the PowerSource support portal
System of record: Student Information System (SIS) databases<p>The support account did not access customer data directly.<p>Instead, operations were executed through the PowerSource support interface, which could trigger actions against customer databases.<p>In effect, the support portal functioned as an execution mechanism for operations on production databases.<p>This makes the incident less about direct database access and more about the execution authority embedded in the support interface.