Privileged Identities

Privileged Identities

Learning what is at the core of online attacks

Over the last year, we have witnessed a series of staggering data breaches affecting some of the world’s leading businesses— with each breach seemingly worse than the last in terms of financial and reputational damage.

Following intrusions into Target, JP Morgan, Sony Pictures and others, many people are asking “has it reached the point where no system is ever fully protected from hackers?”

The unfortunate answer to this question is that if an intruder wants into your network—they will get in—no matter how many perimeter defenses you build around your IT infrastructure. It is vital for IT departments to anticipate that their systems will be breached, and their most sensitive data could be stolen and made public.

Therefore, the real question that corporate executives should be asking themselves is: what can be done to minimize the damage of a cyberattack on my organization?

The Keys to Your IT Kingdom, Privileged Identities

The lesson from the recent Sony Pictures hack is that organizations that do not have a security solution which can limit damage internally are taking remarkable risks and acting extraordinarily naive about the advanced capabilities of today’s cyber attackers.

That’s because one of the most common ways for cybercriminals to gain access to systems is through unsecured privileged accounts. Privileged accounts provide the access needed to view and extract critical data, alter system configuration settings, and run programs on just about every hardware and software asset in the enterprise.

Almost every account on the network has some level of privilege associated with it and can potentially be exploited by a hacker. For example, business applications and computer services store and use privileged identities to authenticate with databases, middleware, and other application tiers when requesting sensitive information and computing resources.

In fact, there are so many privileged accounts in large enterprises that many organizations don’t even know where all of their privileged accounts reside—or who has access to them.

Unlike personal login credentials, privileged identities are not typically linked to any one individual and are often shared among multiple IT administrators with credentials that are rarely—if ever—changed.

The Privileged Account Attack Vector

Cyber attackers need privileged access to carry out their illicit plans—whether it’s to install malware or key loggers, steal or corrupt data, or disable hardware. That’s why privileged account credentials are in such high demand by hackers. In fact, research conducted by Mandiant revealed that 100 percent of the data breaches they investigated involved stolen credentials.

A destructive data breach can begin with the compromise of just one privileged account. Criminal hackers and malicious insiders can exploit an unsecured privileged account to gain the persistent administrative access they need to anonymously extract sensitive data.

As stated previously, if attackers want to get into your environment, they will— and there’s really no way to prevent it short of creating an “air gap” to isolate your most critical systems from the rest of your network. Conventional perimeter security tools that most organizations rely on, like firewalls, react too late to defend against new advanced persistent threats and zero day attacks.

So, the issue is not whether attackers will penetrate your perimeter, but what will happen once they’re in. The first thing they will do is look for ways to expand their access. Usually remote access kits, routers and key loggers are installed. The intruder’s goal is to extract the credentials that will give them lateral motion throughout the network.

To accomplish this, attackers look for SSH keys, passwords, certificates, Kerberos tickets and hashes of domain administrators on compromised machines. Often, hackers will quietly monitor and record activity on the systems, and then use this information to expand their control of the IT environment.

This is the classic “land and expand” attack, and the entire activity can be completed in about 15 minutes. It doesn’t take long because most of these attacks use automated hacking tools.

Next Generation Adaptive Privilege Management

Given the fact that your adversaries are using highly advanced automated tools to attack, shouldn’t you match their efforts with your own automated security solutions?

Adaptive privilege management is an automated cyber defense solution that proactively secures privileged accounts in response to a stimulus. For example, an organization’s logger, SIEM, or trouble ticket system reports an anomaly. Then, the adaptive privilege management solution uses that information to look up the address—say, in LDAP or a configuration management database (CMDB)—to determine what is being targeted.

If the organization under attack has a hundred sets of systems, the adaptive privilege management solution might have a hundred password change jobs in place to manage those credentials. Based on the outside stimulus, the solution can call PowerShell or another web service with the appropriate password change job and begin immediate remediation.

Adaptive privilege management works in conjunction with detect-and-respond software to react to notifications that those products produce, and immediately change the credentials on systems under attack. Every time the intrusion detection system spots a new event, the credentials are changed again.

The goal is to block intruders by responding with new credentials as soon as any logins are compromised. Essentially, when hackers harvest a credential, the solution deploys new credentials—effectively minimizing lateral motion inside the environment, even in zero day attack scenarios.

The basic idea is continuous detection and remediation. Adaptive privilege management automatically discovers privileged accounts throughout the enterprise, brings those accounts under management, and audits access to them.

Remember, if you can’t find the privileged accounts on your network, you can’t secure them. But just because you may not know where all of your privileged accounts reside, that doesn’t mean the bad guys can’t locate these powerful accounts—and leverage them to execute their cyberattacks.

The reality of today’s cyber security landscape is that attackers can breach your network regardless of your countermeasures. Fortunately, with adaptive privilege management you can remediate security threats faster than cyber attackers can exploit them.

This article originally appeared in the August 2015 issue of Security Today.

Featured

  • Security Today Launches 2023 Government Security Awards

    Security Today Launches 2023 Government Security Awards

    Security Today is proud to announce the launch of the 2023 Government Security Awards. The Govies honor outstanding government security products in a variety of categories. For this year’s awards program, participants can choose from 38 different categories to enter their product(s) into. Read Now

  • Back to the Basics

    Back to the Basics

    Security is a continuous evolution of practices and procedures. The developments in technology and advancements in threats make security difficult at times. Although security from one location may look different from another location, there is a common goal applied to security measures. The common goal is protection. Read Now

  • The Top Three Security Trends in 2023

    The Top Three Security Trends in 2023

    As security technology has become more widely used, the interest in new capabilities and increased security measures has increased. As we head into 2023, these three trends will shape the security landscape. Read Now

  • TSA Breaks Record Nationally and in Washington for Firearm Discoveries in 2022

    TSA Breaks Record Nationally and in Washington for Firearm Discoveries in 2022

    Transportation Security Administration (TSA) officers in Washington detected 164 firearms in travelers’ carry-on luggage in 2022, with the majority of the firearms discovered at Seattle-Tacoma International Airport’s (SEA) security checkpoints. Read Now

Featured Cybersecurity

New Products

  • VideoEdge 2U High Capacity Network Video Recorder

    VideoEdge 2U High Capacity Network Video Recorder

    Johnson Controls announces a powerful recording solution to meet demanding requirements with its VideoEdge 2U High Capacity Network Video Recorder. This solution combines the powerful capabilities of victor with the intelligence of VideoEdge NVRs, fueled by Tyco Artificial Intelligence, for video management that provides actionable insights to save time, money and lives. 3

  • BriefCam v6.0

    BriefCam v6.0

    BriefCam has released BriefCam v6.0, which introduces the new deployment option of a multi-site architecture. This enables businesses with multiple, distributed locations to view aggregate data from all remote sites to uncover trends across locations, optimize operations and boost real-time alerting and response – all while continuing to reap the benefits of BriefCam's powerful analytics platform for making video searchable, actionable and quantifiable. 3

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3