Risk
11/7/2012
12:36 AM
50%
50%

Build Roadblock For Attacks Through Rule Of Least Privilege

Attack against Coke shows once again why organizations need to better control their privileged accounts

Reports surfacing this week about a 2009 deep dive by Chinese hackers into Coca-Cola IT infrastructure that potentially scuppered a huge merger stand as evidence once again that enterprises need to be better at enforcing the rule of least privilege, security experts warn. If reports from BloombergBusinessweek hold true, the 2009 attack against Coke follows a remarkably familiar script, as attackers sent malware-laden spearphishing messages to company executives, owned their machines, and leveraged privileged accounts held by the victims to gain further access into the network.

"Privileged accounts have emerged as the primary target for attackers -- if you examine some of the most spectacular breaches of the past few years, they all have a privileged connection," says Adam Bosnian, executive vice president of Americas and corporate development for Cyber-Ark, pointing to other attacks against Global Payments, the U.S. Chamber of Commerce, and the Utah medical records breach. "Hackers gain access to administrative and privileged accounts -- once inside, they elevate privileges to gain access to additional servers, databases, and other high-value systems."

And yet many organizations fail to even assess the risk that elevated rights on endpoints and privileged accounts for network resources pose to their businesses. A survey conducted by privileged management vendor Viewfinity this summer found that 68 percent of organizations didn't even know who had local administrator rights on their machines, a configuration vulnerability frequently used by spearphishing attackers to start attacking the network from the proverbial side door.

According to Bosnian, part of the problem of runaway privileges in the enterprise is that many organizations have too narrow of a view of what exactly a privileged account really is.

"The common belief is that if you're managing the user names, roles, and privileges of your IT employees' personal accounts, then you're successfully controlling all privileged accounts and access," he says. "Whether they're called hard-coded passwords, admin passwords, or privileged accounts, they're all privileged access points that provide a direct -- and often anonymous -- route to an organization's most sensitive data and infrastructure."

By rights, adherence to the rule of least privilege -- or the maxim that no account should ever have more rights authorized to it than necessary for a user to get his job done -- should be the No. 1 driver for identity and access management, says Marcus Carey, security researcher for Rapid7.

"This is critical because limiting privileges is an excellent way to limit the spread of malware once network resources are compromised," he says. "However, the principle of 'least privilege' is one of the hardest information security tenets to maintain. It is nearly impossible for large enterprises to manage this without identity and access management."

[Hackers fixate on SQL injections -- CSOs, not so much. See The SQL Injection Disconnection.]

Of course, IAM products alone can't do much to enforce the rule of least privilege. It also takes coordinated effort to focus automation, policy, and teamwork into the right direction. For example, frequent access reviews are important to prevent privileges from creeping upward, says Jackson Shaw, senior director of product management at Quest Software, now a part of Dell.

"Embrace an access review policy and regular, automated access alerts that notify two or more administrators of access changes, employee changes, or other critical issues," Shaw says. "Notifying more than one administrator helps overcome negligence. To prevent access creep, access privileges must be dynamically linked to human resources and staffing databases."

Similarly, best practices should drive IAM implementation choices that lead to restrictions in privilege authorizations that lead to a least privilege posture, Shaw says.

"Some of the most common implementation options to help get to a least-privilege state include assigning appropriate access directly to users based on well-defined roles, limiting access to administrator and root accounts, and making sure that the passwords to these accounts are not shared, are changed frequently, and that there are controls in place to limit and track their use," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jay O'Donnell
50%
50%
Jay O'Donnell,
User Rank: Apprentice
12/10/2012 | 6:48:55 PM
re: Build Roadblock For Attacks Through Rule Of Least Privilege


Interesting
read - It is true enterprises must put forth extra effort to ensure hackers
cannot access privileged accounts. It is important to track employees from
their first day to their last day, including any changes in responsibility
that happen in between, thereby ensuring that they never have too much or too
little network access. The N8 Identity Employee Lifecycle Manager (ELM)
software solution simplifies this process while delivering compliance at
every level . I'd be interested to hear what you think:
http://n8id.com/our-offering/e...


Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7896
Published: 2015-03-03
Multiple cross-site scripting (XSS) vulnerabilities in HP XP P9000 Command View Advanced Edition Software Online Help, as used in HP Device Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Tiered Storage Manager 6.x through 8.x before 8.1.2-00, HP XP P9000 Replication Manager 6.x and 7.x before ...

CVE-2014-9283
Published: 2015-03-03
The BestWebSoft Captcha plugin before 4.0.7 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

CVE-2014-9683
Published: 2015-03-03
Off-by-one error in the ecryptfs_decode_from_filename function in fs/ecryptfs/crypto.c in the eCryptfs subsystem in the Linux kernel before 3.18.2 allows local users to cause a denial of service (buffer overflow and system crash) or possibly gain privileges via a crafted filename.

CVE-2015-0656
Published: 2015-03-03
Cross-site scripting (XSS) vulnerability in the login page in Cisco Network Analysis Module (NAM) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCum81269.

CVE-2015-0890
Published: 2015-03-03
The BestWebSoft Google Captcha (aka reCAPTCHA) plugin before 1.13 for WordPress allows remote attackers to bypass the CAPTCHA protection mechanism and obtain administrative access via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.