In mid-October the USCC congressional commission gave IT professionals an early Halloween scare with its report on an emerging cyber warfare threat. The 88 page document, compiled by a team at Northrop Grumman, presents in unsettling detail the anatomy of a 2008 attack on a US company’s IT infrastructure that succeeded in providing at least some measure of sensitive data to overseas spies. The report makes this gloomy assessment:
“US government and private sector information, once unreachable or requiring years of expensive technological or human asset preparation to obtain, can now be accessed, inventoried, and stolen with comparative ease using computer network operations tools.”
The USCC report details how overseas agents use a multi –faceted approach to create potent cyber attacks. First, they combine zero-day exploits they develop in-house with clever social engineering to deliver malicious payloads onto target systems with surprising consistency.
Once a single computer is compromised, the intruders leapfrog from system to system, compromising “highly sensitive privileged accounts” throughout the organization until the infrastructure is mapped and its most valued information can be extracted quickly enough to render conventional safeguards powerless. The report sums it up by saying,
“These operators exploit this reactive defense model and they have the resources necessary to develop and exploit previously unknown vulnerabilities that are often missed by signature-based IDS/IPS and endpoint protection software.”
With no end in sight to new vulnerabilities that appear in desktop applications, web services, operating systems and even network appliances, how can organizations safeguard their most sensitive data from attack?
Today there’s a software solution that, within a short period of time, can discover and catalog the privileged accounts everywhere in your enterprise – in applications and web services, databases, operating systems, and so on. The software then isolates interdependent services to maintain the absolute minimum of commonality among privileged credentials, continuously hardening and changing all of the passwords and permitting delegated check-out only by authorized IT staff. That way a single compromised system has only short-term value and can’t become an easy launching point to expose your entire infrastructure.
To download a copy of the USCC report visit http://www.uscc.gov/researchpapers/2009/NorthropGrumman_PRC_Cyber_Paper_FINAL_Approved%20Report_16Oct2009.pdf.
Chris Stoneff, principal product manager at Lieberman Software Corporation, a Los Angeles-based developer of privileged identity management software.