Enterprise cybersecurity technology research that connects the dots.

Colonial Pipeline Cyberattack Proves a Single Password Isn't Enough

Since the attack, it's been revealed that it was down to a single password. Yes, ransomware needs to be on your radar -- but a focus on credentials is vital.

Hollie Hennessy, Principal Analyst, IoT Cybersecurity, Omdia

June 14, 2021

3 Min Read
Dark Reading logo in a gray background | Dark Reading

Back in May, the Colonial Pipeline's operations came to a halt following a ransomware attack. In just a few weeks, a cybersecurity executive order was put in place, ransom was paid, and the FBI even managed to recover most of it.

But now that the attack vector has been revealed, the details show that ransomware isn't the only issue enterprises should worry about — but passwords as well.

Led by cybercriminal gang DarkSide, a cyberattack against the Colonial Pipeline forced the organization to stop all operations on May 7, 2021, in order to deal with the incident.

The gang asked for a ransom payment in exchange for decrypting the company's data. Colonial alerted the FBI immediately and paid up in the form of a $4.4 million ransom payment. However, the FBI revealed most of that payment has been recovered.

Following this, Colonial CEO Joseph Blount confirmed in recent testimony to the US Senate Committee on Homeland Security and Governmental Affairs that the attack, disappointingly, happened thanks to the compromise of a single password.

The DarkSide gang was able to acquire the password to a VPN account that was no longer in use yet remained active. The single-factor authentication method granted the attackers access to Colonial's IT network and, in turn, its sensitive data.

The incident highlights several mistakes that are critical for enterprises in order to avoid falling victim to similar attacks — one being a lack of multi- or two-factor authentication.

The breach is a clear example of how an IT-driven compromise can shut down OT environments. For organizations, especially those operating critical national infrastructure, the likelihood of and potential for a ransomware attack must be taken into account.

Following a huge spike in enterprise ransomware incidents in 2020, the growing risk underscores the need for every enterprise to assess its risk posture and address its security gaps, with a remediation policy in place. This needs to happen now.

There's also the need for organizations to seriously consider increasing their investments in cybersecurity in order to ensure good security "hygiene."

Although Omdia's ICT Enterprise Insights 2021 survey revealed that 60% of manufacturing companies are planning to increase investment in cybersecurity, which is promising, that still leaves another 40%. This group, although the minority, are maintaining or potentially reducing investment. With high-profile attacks like the Colonial Pipeline highlighting the significant risks, companies must do more to be prepared. Proper security hygiene requires a layered approach, and part of that is updating and maintaining passwords.

The CEO highlighted how the compromised password wasn't something easily guessable like "Colonial123," but that's beside the point when access was granted simply by stealing it. Credentials are a huge risk factor when it comes to compromise. The 2021 "Data Breach Investigations Report" (DBIR) by Verizon highlighted that a majority (61%) of breaches were attributed to leveraged credentials.

Conclusions
The Colonial Pipeline attack clearly highlights the importance of a multilayered approach to cybersecurity and specifically ransomware prevention; no stone must be left unturned, no matter how basic it may seem. Just one forgotten user account can provide all the opportunity an attacker needs.

About the Author

Hollie Hennessy

Principal Analyst, IoT Cybersecurity, Omdia

Hollie works as a Principal Analyst within the Omdia team, providing insight into the fascinating and fast-moving domain of IoT Cybersecurity.

Hollie has a range of experience in research. She began her career in the legal sector, writing and researching for expert witness reports on the labour market. She then moved into product testing, with a consumer protection focus. In this role she was responsible for managing comparative tests of various tech products, as well as regular testing and investigative work into the security of these products.

She has published various articles for Which?, the UK's largest consumer organisation and one of the largest subscription magazines, and Computing magazine.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights