Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/13/2019
01:30 PM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail

6 Questions to Ask Once Youve Learned of a Breach

With GDPR enacted and the California Consumer Privacy Act on the near horizon, companies have to sharpen up their responses. Start by asking these six questions.
5 of 7

4. Does the threat actor still have access to our IT environment? 
So you're well into the process and even have determined how the attacker got in; now it's time to find out if the attacker still has access and how are they maintaining access, says FireEye Mandiant's Carmakal. For example, the attackers may have installed a persistent backdoor, may be leveraging the company's VPN, or may have credentials for user accounts with privileged access.

FireEye Mandiant's Carmakal says threat actors take advantage of both privileged and non-privileged accounts. Privileged accounts often undergo less scrutiny by security teams. But Shay Nahari, who heads red-team services for CyberArk, points out that infiltrating privileged accounts gives attackers access to sensitive resources and databases, a good reason to focus in on managing those accounts.

Image Source: Adobe Stock: Sergey Ksenofontov

4. Does the threat actor still have access to our IT environment?

So you're well into the process and even have determined how the attacker got in; now it's time to find out if the attacker still has access and how are they maintaining access, says FireEye Mandiant's Carmakal. For example, the attackers may have installed a persistent backdoor, may be leveraging the company's VPN, or may have credentials for user accounts with privileged access.

FireEye Mandiant's Carmakal says threat actors take advantage of both privileged and non-privileged accounts. Privileged accounts often undergo less scrutiny by security teams. But Shay Nahari, who heads red-team services for CyberArk, points out that infiltrating privileged accounts gives attackers access to sensitive resources and databases, a good reason to focus in on managing those accounts.

Image Source: Adobe Stock: Sergey Ksenofontov

5 of 7
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
0%
100%
REISEN1955,
User Rank: Ninja
9/16/2019 | 3:22:27 PM
Nouns
Words are important and ages ago Cliff Stoll wrote an engaging book THE CUCKOO'S NEST which should be required reading for any cyber pro.  In this book, at one point, he was asked by the FBI to define the threat and theft.  Their language was proper and mild and I think this is so here...

Threat Actor?  No - how about Bald Faced Criminal

Ongoing?  No, how about barn door still unlocked?

Data theft?  No, how above did they empty Fort Knox.

Ongoing?  No, are the black trucks still at the docking back.

Restoration protocol?  No, are we still screwed in putting shit back-together?

Don't have a plan?  are we then up Schitt's creek with no paddle or boat? 

I noticed that responsibility for defense was not mentioned?
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11547
PUBLISHED: 2020-04-05
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVE-2020-11548
PUBLISHED: 2020-04-05
The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.
CVE-2020-11542
PUBLISHED: 2020-04-04
3xLOGIC Infinias eIDC32 2.213 devices with Web 1.107 allow Authentication Bypass via CMD.HTM?CMD= because authentication depends on the client side's interpretation of the <KEY>MYKEY</KEY> substring.
CVE-2020-11533
PUBLISHED: 2020-04-04
Ivanti Workspace Control before 10.4.30.0, when SCCM integration is enabled, allows local users to obtain sensitive information (keying material).
CVE-2020-11529
PUBLISHED: 2020-04-04
Common/Grav.php in Grav before 1.6.23 has an Open Redirect.