Story image

Hacking of national security projects highlights importance of patching

11 Oct 17

The recent release of the Australian Cyber Security Centre (ACSC) 2017 report revealed a small breach – with massive implications.

In November 2016, the ACSC became privy to a malicious hacking of a small Australian company with contracting links to national security projects where a cybercriminal had successfully compromised the network.

According to ACSC, the adversary had sustained and active access to the network for an extended period of time, stealing a significant amount of data in the process.

This included technical information on jet fighters, transport aircraft, ‘smart bomb kits’ and more. The data was breached on a network with no regular patching regime and a common local admin account password for all servers. 

ACSC asserts the cybercriminal gained access to the company’s network by exploiting an Internet-facing server before using administrative credentials to move laterally through the network where they were able to install multiple webshells throughout the network to gain and maintain further access.

Chief security strategist at Exabeam, Stephen Moore says a large number of cyberattacks today take advantage of well-known vulnerabilities – for which patches do usually exist.

“But while it seems easy to point a finger at those who have unpatched systems, patch management can be a very complex process, not least for a company where just one person manages all IT-related functions,” says Moore.

“That’s why it is important to be able to detect unusual usage of credentials, or in other words, see unusual user behaviour on the network. If an employee begins moving around a network accessing multiple file servers and databases for the first time, and no one else in their department has done so, it can be an indicator of a stolen – but valid – credential.”

Moore says simply ensuring that passwords are complex often doesn’t help in stopping credential-based attacks – something that global security advocate at Digital Guardian, Thomas Fischer agrees with.

Fischer says breaches as this reinforce why all companies regardless of size need to adopt a ‘patch early, patch often’ mantra.

“They also need to regularly review system settings and disable unnecessary services that could leave them open to attack,” Fischer says.

“Unfortunately, businesses continue to underestimate the importance of patching. Keeping IT systems constantly updated and free from known vulnerabilities is truly essential. Most companies, at some point, will have their networks' breached.”

In the aforementioned case, the sensitive defence data was freely accessible due to seemingly no encryption or access control measures in place, which is why Fischer says breaches don’t always have to result in data theft.

“Data-centric security technologies can greatly reduce an attacker's ability to successfully exfiltrate data,” says Fischer.

“This is because, even if attackers gain access to sensitive data, they would be prevented from copying, moving or deleting it without approval.”

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.