Cluelessly Compromised
Many people believe cybersecurity compromises are the work of a genius hacker, working in his labs will sorts of gadgets and screens, who finds the loophole and then initiates his attack. While this could definitely happen, the truth is much more mundane: usually it is your company that leaves the door wide-open, and the hacker just decides to waltz in. It is really that simple.
How is the door wide open? This is by being operationally blind: meaning as a company we do not have a proper inventory of our digital infrastructure. They don’t know all the servers and applications that are running and being used, and hence they don’t know what to protect in the first place. For this kind of oblivion, the hacker finds the right open door and comes in with complete ease.
How are Companies Clueless
A number of bad practices lead to this phenomenon of “unknown unknowns.” One such bad practice is Shadow IT. Departments, out of a sense of urgency, or circumventing bureaucracy, would build and run their own IT assets away from the core IT and security team. These are assets that are part of the network (hence they constitute vulnerability points) but IT has no idea about them. Hence, they are not part of the regular scanning and protection activities undergone.
Another way is not keeping track of updated and patches. In day 1, all infrastructure is secure, monitored and protected. After 1 year, after countless patches, upgrades, new systems, etc... the infrastructure looks nothing like it was in day 1. Lack of tracking and not following the right protocols consequently leads to this uncontrolled evolution of the infrastructure.
Credentials are also not properly managed, and hence hackers can find them here and there to maliciously leverage. For example, credentials for resigned employees can remain way after they have left which eventually becomes used by the hacker. Or, API keys are hardcoded into code, leading to their leakage across source control systems.
The Remedy
Such situations are not without solutions. Deciding from today to engage in certain rectifying practices starts a positive dynamic that eventually resolves such problems. The first step is to conduct a proper inventory of all IT assets, since we cannot protect what we don’t know. Also, to put tight controls to prevent unauthorized, untracked or unmanaged changes to the IT infrastructure such that all IT assets are accounted for at all times.
It also important to harden the authentication layer with mandatory multi-factor authentication (MFA) and expiring credentials frequently. Also, accounts deemed inactive must be terminated immediately.
Another such practice is to establish effective monitoring which, coupled with proper analyzing tools, can make right judgements on abnormal behavior. E.g. an employee logs in from an IP in his hometown, and then ten minutes later from a VM in a foreign country. This requires establishing a baseline reference for what normal traffic and behavior looks like to be used to compare suspicious behavior. This prevents the frequency of false positives which in turn leads to security fatigue.
The era of "set it and forget it" security is over. In the modern threat landscape, being compromised is a matter of ‘when’, not ‘if’. Being “clueless” is a choice that hackers rely on, and they will attack at the first provided opportunity. While nothing is guaranteed, proactively employing good cybersecurity hygiene greatly reduces the risk of the upcoming impeding attack.