Risk
11/7/2012
00:36 AM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Build Roadblock For Attacks Through Rule Of Least Privilege

Attack against Coke shows once again why organizations need to better control their privileged accounts

Reports surfacing this week about a 2009 deep dive by Chinese hackers into Coca-Cola IT infrastructure that potentially scuppered a huge merger stand as evidence once again that enterprises need to be better at enforcing the rule of least privilege, security experts warn. If reports from BloombergBusinessweek hold true, the 2009 attack against Coke follows a remarkably familiar script, as attackers sent malware-laden spearphishing messages to company executives, owned their machines, and leveraged privileged accounts held by the victims to gain further access into the network.

"Privileged accounts have emerged as the primary target for attackers -- if you examine some of the most spectacular breaches of the past few years, they all have a privileged connection," says Adam Bosnian, executive vice president of Americas and corporate development for Cyber-Ark, pointing to other attacks against Global Payments, the U.S. Chamber of Commerce, and the Utah medical records breach. "Hackers gain access to administrative and privileged accounts -- once inside, they elevate privileges to gain access to additional servers, databases, and other high-value systems."

And yet many organizations fail to even assess the risk that elevated rights on endpoints and privileged accounts for network resources pose to their businesses. A survey conducted by privileged management vendor Viewfinity this summer found that 68 percent of organizations didn't even know who had local administrator rights on their machines, a configuration vulnerability frequently used by spearphishing attackers to start attacking the network from the proverbial side door.

According to Bosnian, part of the problem of runaway privileges in the enterprise is that many organizations have too narrow of a view of what exactly a privileged account really is.

"The common belief is that if you're managing the user names, roles, and privileges of your IT employees' personal accounts, then you're successfully controlling all privileged accounts and access," he says. "Whether they're called hard-coded passwords, admin passwords, or privileged accounts, they're all privileged access points that provide a direct -- and often anonymous -- route to an organization's most sensitive data and infrastructure."

By rights, adherence to the rule of least privilege -- or the maxim that no account should ever have more rights authorized to it than necessary for a user to get his job done -- should be the No. 1 driver for identity and access management, says Marcus Carey, security researcher for Rapid7.

"This is critical because limiting privileges is an excellent way to limit the spread of malware once network resources are compromised," he says. "However, the principle of 'least privilege' is one of the hardest information security tenets to maintain. It is nearly impossible for large enterprises to manage this without identity and access management."

[Hackers fixate on SQL injections -- CSOs, not so much. See The SQL Injection Disconnection.]

Of course, IAM products alone can't do much to enforce the rule of least privilege. It also takes coordinated effort to focus automation, policy, and teamwork into the right direction. For example, frequent access reviews are important to prevent privileges from creeping upward, says Jackson Shaw, senior director of product management at Quest Software, now a part of Dell.

"Embrace an access review policy and regular, automated access alerts that notify two or more administrators of access changes, employee changes, or other critical issues," Shaw says. "Notifying more than one administrator helps overcome negligence. To prevent access creep, access privileges must be dynamically linked to human resources and staffing databases."

Similarly, best practices should drive IAM implementation choices that lead to restrictions in privilege authorizations that lead to a least privilege posture, Shaw says.

"Some of the most common implementation options to help get to a least-privilege state include assigning appropriate access directly to users based on well-defined roles, limiting access to administrator and root accounts, and making sure that the passwords to these accounts are not shared, are changed frequently, and that there are controls in place to limit and track their use," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jay O'Donnell
50%
50%
Jay O'Donnell,
User Rank: Apprentice
12/10/2012 | 6:48:55 PM
re: Build Roadblock For Attacks Through Rule Of Least Privilege


Interesting
read - It is true enterprises must put forth extra effort to ensure hackers
cannot access privileged accounts. It is important to track employees from
their first day to their last day, including any changes in responsibility
that happen in between, thereby ensuring that they never have too much or too
little network access. The N8 Identity Employee Lifecycle Manager (ELM)
software solution simplifies this process while delivering compliance at
every level . I'd be interested to hear what you think:
http://n8id.com/our-offering/e...


Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-5704
Published: 2014-04-15
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

CVE-2013-5705
Published: 2014-04-15
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.

CVE-2014-0341
Published: 2014-04-15
Multiple cross-site scripting (XSS) vulnerabilities in PivotX before 2.3.9 allow remote authenticated users to inject arbitrary web script or HTML via the title field to (1) templates_internal/pages.tpl, (2) templates_internal/home.tpl, or (3) templates_internal/entries.tpl; (4) an event field to ob...

CVE-2014-0342
Published: 2014-04-15
Multiple unrestricted file upload vulnerabilities in fileupload.php in PivotX before 2.3.9 allow remote authenticated users to execute arbitrary PHP code by uploading a file with a (1) .php or (2) .php# extension, and then accessing it via unspecified vectors.

CVE-2014-0348
Published: 2014-04-15
The Artiva Agency Single Sign-On (SSO) implementation in Artiva Workstation 1.3.x before 1.3.9, Artiva Rm 3.1 MR7, Artiva Healthcare 5.2 MR5, and Artiva Architect 3.2 MR5, when the domain-name option is enabled, allows remote attackers to login to arbitrary domain accounts by using the corresponding...

Best of the Web