Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Counter Attack: Control the Credentials, Control the Compromise
Newest First  |  Oldest First  |  Threaded View
tdsan
tdsan,
User Rank: Ninja
11/30/2017 | 11:57:08 AM
Interesting article
One thing I was curious about, if someone let's say places a key-logger in your environment or places a worm where the worm's or key-logger's only purpose is to capture keystokes or usernames/passwords, then your premise "Control the Credentials, Control the Compromise" would be circumvented.

Also, if someone accessed a website or nefarious email, then you would still control the credentials, but the access to the system would be in the form of an APT or root-kit but is downloaded in the background, thus again, your system is compromised, and you still have control of the credentials.

This is not a silver bullet solution, we can only try to security our environment by controlling the Keys/Credentials, NGFW, locked down servers, Zone policies, SIEM devices, trained staff, but with all of that, they could access our servers over the power lines (EoP). Good luck with your commentary, it seems there are a few things that have been left out as part of the discussion.

T

 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building the SOC of the Future
While an attacker just needs to find one vulnerability to get in to the network, the defender has to look everywhere. Defenders have to identify, disrupt, and stop attacks in the short period of time between when an attacker gets in and causes damage. One way is a security operations center to get that "all the time" coverage. What's Inside: --AI and cybersecurity response --Automation --Proctive threat hunting --Next-gen SIEM
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-22493
PUBLISHED: 2022-10-07
IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-Force ID: 226449.
CVE-2022-30613
PUBLISHED: 2022-10-07
IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366.
CVE-2022-34308
PUBLISHED: 2022-10-07
IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437.
CVE-2022-36772
PUBLISHED: 2022-10-07
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user.
CVE-2022-41291
PUBLISHED: 2022-10-07
IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 236699.