sb-as logo
Story image

Hacking of national security projects highlights importance of patching

11 Oct 2017

The recent release of the Australian Cyber Security Centre (ACSC) 2017 report revealed a small breach – with massive implications.

In November 2016, the ACSC became privy to a malicious hacking of a small Australian company with contracting links to national security projects where a cybercriminal had successfully compromised the network.

According to ACSC, the adversary had sustained and active access to the network for an extended period of time, stealing a significant amount of data in the process.

This included technical information on jet fighters, transport aircraft, ‘smart bomb kits’ and more. The data was breached on a network with no regular patching regime and a common local admin account password for all servers. 

ACSC asserts the cybercriminal gained access to the company’s network by exploiting an Internet-facing server before using administrative credentials to move laterally through the network where they were able to install multiple webshells throughout the network to gain and maintain further access.

Chief security strategist at Exabeam, Stephen Moore says a large number of cyberattacks today take advantage of well-known vulnerabilities – for which patches do usually exist.

“But while it seems easy to point a finger at those who have unpatched systems, patch management can be a very complex process, not least for a company where just one person manages all IT-related functions,” says Moore.

“That’s why it is important to be able to detect unusual usage of credentials, or in other words, see unusual user behaviour on the network. If an employee begins moving around a network accessing multiple file servers and databases for the first time, and no one else in their department has done so, it can be an indicator of a stolen – but valid – credential.”

Moore says simply ensuring that passwords are complex often doesn’t help in stopping credential-based attacks – something that global security advocate at Digital Guardian, Thomas Fischer agrees with.

Fischer says breaches as this reinforce why all companies regardless of size need to adopt a ‘patch early, patch often’ mantra.

“They also need to regularly review system settings and disable unnecessary services that could leave them open to attack,” Fischer says.

“Unfortunately, businesses continue to underestimate the importance of patching. Keeping IT systems constantly updated and free from known vulnerabilities is truly essential. Most companies, at some point, will have their networks' breached.”

In the aforementioned case, the sensitive defence data was freely accessible due to seemingly no encryption or access control measures in place, which is why Fischer says breaches don’t always have to result in data theft.

“Data-centric security technologies can greatly reduce an attacker's ability to successfully exfiltrate data,” says Fischer.

“This is because, even if attackers gain access to sensitive data, they would be prevented from copying, moving or deleting it without approval.”

Story image
McAfee names ThreatQ innovation partner of the year
ThreatQuotient has been named McAfee Global Security Innovation Alliance Partner of the Year for the second consecutive year.More
Story image
PDI acquires Cybera and ControlScan MSS to protect against security threats
The acquisition complements PDI's existing industry-focused cloud product strategy, bringing customers a fully managed, cloud-based network security solution, the company states.More
Story image
Dark net vendors wanting Bitcoin payments for unverified COVID-19 vaccines
As the medicines are being offered on the dark net, purchasers have no way of knowing whether they are genuine, according to Check Point.More
Story image
Palo Alto Networks advances attack surface management with Expanse
"By integrating Expanse's attack surface management capabilities into Cortex after closing, we will be able to offer the first solution that combines the outside view of an organisation's attack surface with an inside view to proactively address all security threats."More
Story image
Cybersecurity strategies must involve every part of the organisation - study
In the past year, a third of the breaches incorporated social engineering techniques and the cost of a breach caused by a human error averaged to $3.33 million. More
Story image
Microsoft top targeted brand by cyber criminals in Q4 2020
In Q4, 43% of all brand phishing attempts related to Microsoft (up from 19% in Q3), as threat actors continued to try to capitalise on people working remotely during the COVID-19 pandemic’s second wave. More