this is susan bradley for cso online recently in the news there was another attack using pulse
secure vpn as an entryway into networks and it reminds me that when there's a breach there's
several key investigations you'll want to perform to better understand the breach
you'll want to try to identify what the attacker's success this information often helps you identify
if you need to notify users or other key industry participants if their information has been
breached but i also try to identify how they access the information understanding the how
like in this case the pulse secure vpn helps you understand for future situations how to best
protect yourself from the next attack for any size firm you want to make sure that you have
resources to disclose that information and to also best investigate and sometimes you have to contact
local investigative arms like the fbi the secret service obviously these are usa based
organization so if you're located elsewhere overseas australia there'll be some internet
crime resources for you to research and reach out to the cyber security unit of the us department of
justice has some resources and some guidance for how to handle cyber incidence and victim
response and like anything there are some steps to take before the cyber intrusion takes place
you want to make sure that you communicate to management as to the risks in your organization
i hope everyone is discussing risks and cyber intrusions to senior management making sure
that they know what is going on out in the outside world is key to understanding
and better protecting yourself next you want to identify what's called your crown jewels those
are those key assets you want to make sure you protect and defend the most again you want to look
at the nist cybersecurity framework which has been widely adopted and can be integrated into existing
risk management and incident response planning you want to have an actionable plan in place
now for smaller organizations you may need to reach out to your cyber insurance because they'll
have resources for you for larger organizations you'll probably have a team that has these plans
in place you may also have something called red teams blue teams even purple teams meaning that
these are our divisions in your organization that do drills inside your organization to make sure
that you're protected and prepared for any cyber intrusion you want to make sure that you know
exactly how to contact key resources any cloud storage service providers any data centers and
you want to make sure that you have a phone list and an email contact list that does not depend
on the firm domain mail infrastructure there could be times where especially in ransomware
the entire firm is impacted so you want to make sure you have alternate ways of communication
if you are large enough you'll want to engage with law enforcement before an incident
make sure you have relationships with your local federal law enforcement agencies
if you're not large enough again reach out to your cyber insurance see what resources
they have for you you want to make sure you have what's called appropriate workplace policies and
this is true for both onboarding employees to your organization to make sure that they handle
passwords properly as well as off-boarding any personnel that leave your organization also make
sure that everyone is educated on to the handling of passwords make sure they understand that when
they go to certain websites what is expected how the onboarding process works how the multi-factor
works make sure that they understand that they're not to hand out passwords to anyone and especially
for those that are developers inside your organization make sure they know how to handle
protection of passwords especially that they don't save things in plain text lately
there's been several key ways that attackers have been found to wiggle into our networks
one of the ways that administrators use to administer networks is remote desktop and lately
logins for 1.3 million windows rdp servers were collected from hacker market
in this marketplace remote desktop accounts can sell as little as three dollars
and not more is seventy dollars per account
rdp is responsible for 70 to 80 of all network breaches that lead to ransomware attacks
think about that so the next time someone in your organization is using a remote desktop protocol
think about the fact that there's a marketplace for these credentials so handle them carefully
you want to reset them you want to make sure that you have multi factors set up you make
sure that you want to have remote desktop gateways additional authentication means
if at any point in time that you're using plain old remote desktop to go from one
machine to another think of the ways that the attackers can use that same methodology
so put additional barriers in their place use two-factor multi authentication
make sure you have limitations in the firewall as to what specific ips can access vrdp
another way that during the pandemic that attackers have been using access means is in vpn
software they know that we're using this quite a bit to enable remote access and so web shells are
being placed in pulse connect secure appliances for further access and persistence in networks
thus you'll want to review the patching level of any vpn software that you use
to connect to your network if you're not up to date on these virtual private
network applications or appliances you're putting your network at risk
back in january of last year citrix vpn software was also subject to vulnerabilities you may need
to review how you're doing patching especially in remote machines during the pandemic if you
use third party vpn software reach out to that vendor to review your patching and deployment
options it's key to keep this software maintained this always make sure that your patching staff is
signed up for software update notifications from the vendor and make sure that there's
an appropriate testing window and deployment window and don't get behind on this basic cyber
security processes include patch management not only of windows security services i should say
windows servers and workstations but also cloud assets applications and especially as i showcased
remote entry points to your network so think of the software that people use to remote into
your network ask yourself do you have a patching process for that software take
the time to understand how an attacker can gain access to your network before they actually do
as always make sure you go out to the youtube channel for the idg tech talk for the latest
information and news until next time this is susan bradley for cso online