Story image

Hacking of national security projects highlights importance of patching

11 Oct 17

The recent release of the Australian Cyber Security Centre (ACSC) 2017 report revealed a small breach – with massive implications.

In November 2016, the ACSC became privy to a malicious hacking of a small Australian company with contracting links to national security projects where a cybercriminal had successfully compromised the network.

According to ACSC, the adversary had sustained and active access to the network for an extended period of time, stealing a significant amount of data in the process.

This included technical information on jet fighters, transport aircraft, ‘smart bomb kits’ and more. The data was breached on a network with no regular patching regime and a common local admin account password for all servers. 

ACSC asserts the cybercriminal gained access to the company’s network by exploiting an Internet-facing server before using administrative credentials to move laterally through the network where they were able to install multiple webshells throughout the network to gain and maintain further access.

Chief security strategist at Exabeam, Stephen Moore says a large number of cyberattacks today take advantage of well-known vulnerabilities – for which patches do usually exist.

“But while it seems easy to point a finger at those who have unpatched systems, patch management can be a very complex process, not least for a company where just one person manages all IT-related functions,” says Moore.

“That’s why it is important to be able to detect unusual usage of credentials, or in other words, see unusual user behaviour on the network. If an employee begins moving around a network accessing multiple file servers and databases for the first time, and no one else in their department has done so, it can be an indicator of a stolen – but valid – credential.”

Moore says simply ensuring that passwords are complex often doesn’t help in stopping credential-based attacks – something that global security advocate at Digital Guardian, Thomas Fischer agrees with.

Fischer says breaches as this reinforce why all companies regardless of size need to adopt a ‘patch early, patch often’ mantra.

“They also need to regularly review system settings and disable unnecessary services that could leave them open to attack,” Fischer says.

“Unfortunately, businesses continue to underestimate the importance of patching. Keeping IT systems constantly updated and free from known vulnerabilities is truly essential. Most companies, at some point, will have their networks' breached.”

In the aforementioned case, the sensitive defence data was freely accessible due to seemingly no encryption or access control measures in place, which is why Fischer says breaches don’t always have to result in data theft.

“Data-centric security technologies can greatly reduce an attacker's ability to successfully exfiltrate data,” says Fischer.

“This is because, even if attackers gain access to sensitive data, they would be prevented from copying, moving or deleting it without approval.”

AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
Why you should leverage a next-gen firewall platform
Through full lifecycle-based threat detection and prevention, organisations are able to manage the entire threat lifecycle without adding additional solutions.
The quid pro quo in the IoT age
Consumer consciousness around data privacy, security and stewardship has increased tenfold in recent years, forcing businesses to make customer privacy a business imperative.
ForeScout acquires OT security company SecurityMatters for US$113mil
Recent cyberattacks, such as WannaCry, NotPetya and Triton, demonstrated how vulnerable OT networks can result in significant business disruption and financial loss.
'DerpTrolling’ faces jail time for Sony DoS attacks
A United States federal court has charged a 23-year-old man for the hacks on Sony Online Entertainment and other major companies back in 2014.
Dropbox strengthens security with raft of new partnerships
Integrations will keep customer content protected and secure with tools for controlling identity access, governing data, and managing devices.