sb-nz logo
Story image

Hacking of national security projects highlights importance of patching

11 Oct 2017

The recent release of the Australian Cyber Security Centre (ACSC) 2017 report revealed a small breach – with massive implications.

In November 2016, the ACSC became privy to a malicious hacking of a small Australian company with contracting links to national security projects where a cybercriminal had successfully compromised the network.

According to ACSC, the adversary had sustained and active access to the network for an extended period of time, stealing a significant amount of data in the process.

This included technical information on jet fighters, transport aircraft, ‘smart bomb kits’ and more. The data was breached on a network with no regular patching regime and a common local admin account password for all servers. 

ACSC asserts the cybercriminal gained access to the company’s network by exploiting an Internet-facing server before using administrative credentials to move laterally through the network where they were able to install multiple webshells throughout the network to gain and maintain further access.

Chief security strategist at Exabeam, Stephen Moore says a large number of cyberattacks today take advantage of well-known vulnerabilities – for which patches do usually exist.

“But while it seems easy to point a finger at those who have unpatched systems, patch management can be a very complex process, not least for a company where just one person manages all IT-related functions,” says Moore.

“That’s why it is important to be able to detect unusual usage of credentials, or in other words, see unusual user behaviour on the network. If an employee begins moving around a network accessing multiple file servers and databases for the first time, and no one else in their department has done so, it can be an indicator of a stolen – but valid – credential.”

Moore says simply ensuring that passwords are complex often doesn’t help in stopping credential-based attacks – something that global security advocate at Digital Guardian, Thomas Fischer agrees with.

Fischer says breaches as this reinforce why all companies regardless of size need to adopt a ‘patch early, patch often’ mantra.

“They also need to regularly review system settings and disable unnecessary services that could leave them open to attack,” Fischer says.

“Unfortunately, businesses continue to underestimate the importance of patching. Keeping IT systems constantly updated and free from known vulnerabilities is truly essential. Most companies, at some point, will have their networks' breached.”

In the aforementioned case, the sensitive defence data was freely accessible due to seemingly no encryption or access control measures in place, which is why Fischer says breaches don’t always have to result in data theft.

“Data-centric security technologies can greatly reduce an attacker's ability to successfully exfiltrate data,” says Fischer.

“This is because, even if attackers gain access to sensitive data, they would be prevented from copying, moving or deleting it without approval.”

Story image
Criminals scale back DDoS attacks after 'abnormal' spike in Q2
The Q2 spike seems to have been short-lived as DDoS activity returns to ‘normal’ levels over Q3, with 73% fewer attacks than seen in the previous quarter.More
Story image
The business case for an in-house ethical hacker
Ethical hackers, also known as penetration testers or white-hat hackers, mimic the techniques used by malicious hackers to try and break into computer systems and discover vulnerabilities before the bad guys can exploit them.More
Story image
Insider threat report reveals deception in the workforce
Insider threats come from people inside an enterprise, whether they divulge proprietary information with nefarious intentions, or are just careless employees that unwittingly share sensitive data, writes Bitglass product marketing manager Juan Lugo.More
Story image
The three-pronged security approach that confronts security breaches head-on
Having these three processes working in tandem is key to cushioning the blow of a breach - which, if insufficiently protected, can take on average 279 days to contain and costs an average of almost US$4 million.More
Story image
Revealed: Imperva publishes research on decade old botnet, responsible for millions of attacks
Imperva Research Labs has revealed findings of a six-month intensive investigation into a botnet that has been exploiting CMS vulnerabilities.More
Story image
How to address cyber-threats as a strategic risk
Becoming a cyber-secure organisation in the face of an evolving threat landscape requires a strategic, business-focused approach to security as opposed to a tactical approach in which security is addressed simply by implementing new tools.More