7 steps to protect against privilege-elevating hacks
Connecting state and local government leaders
Agencies are cracking down on administrative access to mitigate the damage an insider can cause, but hackers are adjusting their tactics as well and aiming them squarely at the federal government.
The Edward Snowden saga painfully demonstrated how the worst case scenario can play out when a trusted insider with elevated privileges on a federal network becomes a turncoat. But it also exposed a longstanding weakness in federal cyber security that relied on ad hoc, or at times nonexistent, privilege management.
Agencies today are cracking down on administrative access in order to mitigate the damage an insider can cause, but hackers and even rival nation states are adjusting their tactics and aiming them squarely at the federal government.
Elsewhere, attackers are applying new techniques to an old attack method that ultimately elevates stolen low-level credentials, enabling hackers to become like mini-Snowdens themselves, able to run amok across protected networks as if they were a trusted insider.
One of the most dangerous attacks occurring against government organizations is a variation of an older technique called Pass The Hash, explained Brad Hibbert, vice president of product strategy and operations for BeyondTrust. The goal of the first part of the attack is to acquire low-level access on any client machine connected to a government network, which can be done in a variety of ways including a simple targeted phishing attack.
"Once hackers get user access to a machine, there are some easy ways that they can then become the local administrator for just that box," Hibbert said. "Then they do two things. First they install spyware or keylogging software so they can capture everything that goes on with that machine. Then they mess with the computer, slowing it down, causing it to act funny or even display an error message. The goal is to get a recognized user to ask for help. When the administrator comes to help, his credentials are then captured too."
And once hackers have administrator access to the network, they can begin to run amok, though Hibbert said the most dangerous ones will keep a low profile, stealing secrets and covering their tracks, just like Snowden. They have essentially stolen a trusted insider's access at that point and if privileges are set too high or left unmanaged, might even have total control over the network.
Last year the National Security Agency announced that it was cutting the number of system administrators at the agency by 90 percent, a move Hibbert said should help, but not completely alleviate the problem. But all agencies can take steps to immediately reduce their risk against these new types of attacks.
Hibbert recommended seven ways agencies can limit their vulnerability. They include:
1. Lower privileges as much as possible for administrators. If an admin needs to work with a certain group or on a certain program, only give him access to those areas. Like other users, administrators should be restricted from areas they don’t work with.
2. Automated password cycling. Users are often prompted to change their passwords, but administrators are often exempted from that policy. Forcing admin password changes can lock hackers out of networks they've previously compromised.
3. One-time passwords. When any administrator wants to make changes or work on a protected system, a one-time password can be issued that only grants access to a specific program. The one-time password can be generated and sent to an approved, known device like a smartphone or password token. That password would need to be entered before an administrator could continue, and it would only be valid for one session, expiring quickly if unused.
4. Video and keystroke logging. Work being performed using administrator access should be automatically logged. Full keystroke logging is most effective, but video logging can also be successful if required.
5. Application review. Agencies should deploy a countersecurity team to look for anomalous behaviors, such as administrators trying to work in areas they aren't responsible for, changes made to security levels, files being copied and anything else that might compromise security. Reviewers might even uncover an administrator whose credentials have been stolen by noting unusual behavior.
6. Multi-faceted security. Given the importance and the power most administrators wield, requiring two or even three-factor access in the form of PIN, token or biometric security should be required across the board.
7. Comprehensive auditing. Not only should the behavior of administrators be monitored, but the process of how someone gains and keeps administrator access should be scrutinized. Expiring access that is no longer needed can minimize damage even if an administrator account isn’t compromised.
According to Hibbert, putting up a superior defense around a network, especially a federal one, simply isn't good enough anymore. Defenses have to be in place outside, inside and through an entire network so that when damage from a breach does occur – and it will – it can be compartmentalized and mitigated.
"Every organization needs to consider privilege management as a core component in their overall security strategy," he said. "That is where the attacks are occurring, and running without a defense against them is just like surrendering all your important information without a fight."