“US government and private sector information, once unreachable or requiring years of expensive technological or human asset preparation to obtain, can now be accessed, inventoried, and stolen with comparative ease using computer network operations tools.”

The USCC report details how overseas agents use a multi –faceted approach to create potent cyber attacks. First, they combine zero-day exploits they develop in-house with clever social engineering to deliver malicious payloads onto target systems with surprising consistency.

	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
		Improving Software Quality to Drive Business Agility
	- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Once a single computer is compromised, the intruders leapfrog from system to system, compromising “highly sensitive privileged accounts” throughout the organization until the infrastructure is mapped and its most valued information can be extracted quickly enough to render conventional safeguards powerless. The report sums it up by saying,

“These operators exploit this reactive defense model and they have the resources necessary to develop and exploit previously unknown vulnerabilities that are often missed by signature-based IDS/IPS and endpoint protection software.”

With no end in sight to new vulnerabilities that appear in desktop applications, web services, operating systems and even network appliances, how can organizations safeguard their most sensitive data from attack?

Today there’s a software solution that, within a short period of time, can discover and catalog the privileged accounts everywhere in your enterprise – in applications and web services, databases, operating systems, and so on. The software then isolates interdependent services to maintain the absolute minimum of commonality among privileged credentials, continuously hardening and changing all of the passwords and permitting delegated check-out only by authorized IT staff. That way a single compromised system has only short-term value and can’t become an easy launching point to expose your entire infrastructure.

To download a copy of the USCC report visit http://www.uscc.gov/researchpapers/2009/NorthropGrumman_PRC_Cyber_Paper_FINAL_Approved%20Report_16Oct2009.pdf.

Chris Stoneff, principal product manager at Lieberman Software Corporation, a Los Angeles-based developer of privileged identity management software.

Related posts:

1. The Informationization Age
2. Shavlik statement on Patch Tuesday by Jason Miller, Data and Security Team Leader, Shavlik Technologies, St. Paul, MN
3. Shavlik Comments on February Patch Tuesday Releases