Hacking of national security projects highlights importance of patching

The recent release of the Australian Cyber Security Centre (ACSC) 2017 report revealed a small breach – with massive implications.

In November 2016, the ACSC became privy to a malicious hacking of a small Australian company with contracting links to national security projects where a cybercriminal had successfully compromised the network.

According to ACSC, the adversary had sustained and active access to the network for an extended period of time, stealing a significant amount of data in the process.

This included technical information on jet fighters, transport aircraft, 'smart bomb kits' and more. The data was breached on a network with no regular patching regime and a common local admin account password for all servers.

ACSC asserts the cybercriminal gained access to the company's network by exploiting an Internet-facing server before using administrative credentials to move laterally through the network where they were able to install multiple webshells throughout the network to gain and maintain further access.

Chief security strategist at Exabeam, Stephen Moore says a large number of cyberattacks today take advantage of well-known vulnerabilities – for which patches do usually exist.

"But while it seems easy to point a finger at those who have unpatched systems, patch management can be a very complex process, not least for a company where just one person manages all IT-related functions," says Moore.

"That's why it is important to be able to detect unusual usage of credentials, or in other words, see unusual user behaviour on the network. If an employee begins moving around a network accessing multiple file servers and databases for the first time, and no one else in their department has done so, it can be an indicator of a stolen – but valid – credential.

Moore says simply ensuring that passwords are complex often doesn't help in stopping credential-based attacks – something that global security advocate at Digital Guardian, Thomas Fischer agrees with.

Fischer says breaches as this reinforce why all companies regardless of size need to adopt a 'patch early, patch often' mantra.

"They also need to regularly review system settings and disable unnecessary services that could leave them open to attack," Fischer says.

"Unfortunately, businesses continue to underestimate the importance of patching. Keeping IT systems constantly updated and free from known vulnerabilities is truly essential. Most companies, at some point, will have their networks' breached.

In the aforementioned case, the sensitive defence data was freely accessible due to seemingly no encryption or access control measures in place, which is why Fischer says breaches don't always have to result in data theft.

"Data-centric security technologies can greatly reduce an attacker's ability to successfully exfiltrate data," says Fischer.

"This is because, even if attackers gain access to sensitive data, they would be prevented from copying, moving or deleting it without approval.