Reduce the ‘blast radius’ in credential attacks, Krebs advises
Connecting state and local government leaders
To protect Active Directory credentials, standard identity security strategies must include multifactor authentication, zero trust and defense-in-depth, according to former CISA Director Chris Krebs.
Identity and credential management are oft-overlooked areas of cybersecurity, but they’re at the crux of many breaches, Chris Krebs, former director of the Cybersecurity and Infrastructure Security Agency, and founding partner of the Krebs Stamos Group, said during a Nov. 3 webinar.
Think of identity as the new perimeter, said Krebs, comparing it to the former cyber approach of perimeter-based security in a conversation with Attivo CTO Tony Cole during BrightTalk’s webinar, “What’s Buried in Every Breach Report that No One is Talking About.”
“Our adversaries are constantly looking for new vulnerabilities. They’re looking for mistakes. They’re looking for exposures, they’re constantly poking and prodding,” Krebs said. “They’re thinking about use cases that designers of services never contemplated 10, 15 years ago, so we have to be agile and responsive and continue to evolve our approaches.”
Credentials are one of the most sought-after data types, according to Verizon’s 2021 Data Breach Investigations Report. That’s because every country connected to the internet is developing a capability to steal them, Krebs said.
“A lot of those techniques of lateral movement across networks and targeting credentials and password spraying – all of these credential-based attacks end up in a fairly rudimentary toolkit for any country to use,” he added.
One of the most vulnerable – and ubiquitous – systems is Microsoft Active Directory, a database and services set that connects users with network resources. “Nearly all AD environments are vulnerable to a powerful, difficult-to-detect technique called attack paths,” according to a September Dark Reading article.
“We know they’re going after AD so we have to have AD-focused tools and capabilities and then work our way out to the users,” Krebs said. That means cybersecurity must moving away from bolting security onto the perimeter and working its way in. Now, it’s about starting from what he calls the crown jewels and working out.
He cited multifactor authentication, zero trust and defense-in-depth as necessary identity security strategies. Krebs also touts giving chief information security officers access to and visibility into AD to be able to detect, investigate and mitigate any problems, rather than keeping it solely within CIO’s purview.
“We have to continue moving out of that posture where everything is about prevention, prevention, prevention,” Krebs said. “Resilience is the key to adaptable, flexible organizations. It’s really about reducing blast radius. If you have a ransomware event, then you lose one cred, you lose one box. It doesn’s spread across the entire enterprise.”
Ransomware continues to be a major problem for government agencies. Consider the attack by the Russian hacker group Nobelium on federal organizations in 2020, and the fact that Microsoft warned of new activity by the group at the end of October.
Krebs cited three drivers of ransomware. First is a target-rich, permissive environment in the installed base – the deployed systems that drive the economy and government agencies. Second, ransomware is profitable for the perpetrators.
“It’s been easy pickings and then they’ve been able to monetize these vulnerable configurations in the organizations,” he said, citing how CNA Financial paid Evil Corp., a Russian cyber crime group, $40 million to regain control of its network in March.
Third is the lack of repurcussions for these actions, Krebs said. “Until you make them feel a little pain, they’re going to keep doing it,” he said. “We have to impose some costs on the bad guys and make them not want to play in the game anymore.”
In mid-October, a multi-country effort that included U.S. agencies such as the FBI and Cyber Command forced ransomware group REvil offline. Associates of the Russian-led group were behind the May attack on Colonial Pipeline, and the attackers directly hit the JBS meatpacking company.
Additional risk comes from a growing threat landscape, which is driven by attackers attracted to what Krebs calls the crown jewels – identity and credentials – and an expanding deployment base as more devices connect to the internet. In short, no agency should take a one-and-done approach to security.
“It is about identity lifecycle management. It’s about good hygiene steps, it’s about detection, it’s about response, it’s about cultivating from cradle to grave the identity,” Krebs said. “You don’t want to be the Ronco oven of security services. It’s not set it, forget it. It’s constant monitoring, detection and management of identity.”