7 steps to protect against privilege-elevating hacks

 

Connecting state and local government leaders

Agencies are cracking down on administrative access to mitigate the damage an insider can cause, but hackers are adjusting their tactics as well and aiming them squarely at the federal government.

The Edward Snowden saga painfully demonstrated how the worst case scenario can play out when a trusted insider with elevated privileges on a federal network becomes a turncoat. But it also exposed a longstanding weakness in federal cyber security that relied on ad hoc, or at times nonexistent, privilege management.

Agencies today are cracking down on administrative access in order to mitigate the damage an insider can cause, but hackers and even rival nation states are adjusting their tactics and aiming them squarely at the federal government.

Elsewhere, attackers are applying new techniques to an old attack method that ultimately elevates stolen low-level credentials, enabling hackers to become like mini-Snowdens themselves, able to run amok across protected networks as if they were a trusted insider.

One of the most dangerous attacks occurring against government organizations is a variation of an older technique called Pass The Hash, explained Brad Hibbert, vice president of product strategy and operations for BeyondTrust. The goal of the first part of the attack is to acquire low-level access on any client machine connected to a government network, which can be done in a variety of ways including a simple targeted phishing attack.

"Once hackers get user access to a machine, there are some easy ways that they can then become the local administrator for just that box," Hibbert said. "Then they do two things. First they install spyware or keylogging software so they can capture everything that goes on with that machine. Then they mess with the computer, slowing it down, causing it to act funny or even display an error message. The goal is to get a recognized user to ask for help. When the administrator comes to help, his credentials are then captured too."

And once hackers have administrator access to the network, they can begin to run amok, though Hibbert said the most dangerous ones will keep a low profile, stealing secrets and covering their tracks, just like Snowden. They have essentially stolen a trusted insider's access at that point and if privileges are set too high or left unmanaged, might even have total control over the network.

Last year the National Security Agency announced that it was cutting the number of system administrators at the agency by 90 percent, a move Hibbert said should help, but not completely alleviate the problem. But all agencies can take steps to immediately reduce their risk against these new types of attacks.

Hibbert recommended seven ways agencies can limit their vulnerability. They include:

1. Lower privileges as much as possible for administrators. If an admin needs to work with a certain group or on a certain program, only give him access to those areas. Like other users, administrators should be restricted from areas they don’t work with.

2. Automated password cycling. Users are often prompted to change their passwords, but administrators are often exempted from that policy. Forcing admin password changes can lock hackers out of networks they've previously compromised.

3. One-time passwords. When any administrator wants to make changes or work on a protected system, a one-time password can be issued that only grants access to a specific program. The one-time password can be generated and sent to an approved, known device like a smartphone or password token. That password would need to be entered before an administrator could continue, and it would only be valid for one session, expiring quickly if unused.

4. Video and keystroke logging. Work being performed using administrator access should be automatically logged. Full keystroke logging is most effective, but video logging can also be successful if required.

5.  Application review. Agencies should deploy a countersecurity team to look for anomalous behaviors, such as administrators trying to work in areas they aren't responsible for, changes made to security levels, files being copied and anything else that might compromise security. Reviewers might even uncover an administrator whose credentials have been stolen by noting unusual behavior.

6. Multi-faceted security. Given the importance and the power most administrators wield, requiring two or even three-factor access in the form of PIN, token or biometric security should be required across the board.

7. Comprehensive auditing. Not only should the behavior of administrators be monitored, but the process of how someone gains and keeps administrator access should be scrutinized. Expiring access that is no longer needed can minimize damage even if an administrator account isn’t compromised.

According to Hibbert, putting up a superior defense around a network, especially a federal one, simply isn't good enough anymore. Defenses have to be in place outside, inside and through an entire network so that when damage from a breach does occur – and it will – it can be compartmentalized and mitigated.

"Every organization needs to consider privilege management as a core component in their overall security strategy," he said. "That is where the attacks are occurring, and running without a defense against them is just like surrendering all your important information without a fight."  

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.