It’s also why it’s important for organizations to segment their networks and make sure people only have access to the files and servers they absolutely need to be able to access for their work.ĬOVID Testing of Asymptomatic Students Doesn’t Make Kids Safer
#Solarwinds orion breach install#
Weeding out the malware that they were used to install can be trickier, especially if there are multiple types of malware being used (as was the case in the OPM breach), but that malware is also often constrained at least a little by the system’s security measures and the level of privilege of the compromised credentials-that’s why compromising the credentials of a system administrator, for instance, who has access to an entire network, is often more fruitful for attackers than compromising the credentials of an employee who can only access a smaller portion of the network for their job. Those credentials, depending on whom they belong to and how much access that individual has, can be very effective ways to gain a toehold in a protected computer system, but they’re also very easy to change or reset when the compromise is discovered. Many cyberespionage activities begin with phishing campaigns or stolen credentials, which are then used to deliver malware to targeted systems. That’s not to say that cleaning up the OPM breach-or Sony Pictures or Equifax, for that matter-was easy or straightforward, just that it was a fairly well-bounded problem by comparison to what we’re facing with SolarWinds. This meant that there were some very clear sources that could be used to trace the scope of the incident after the fact-what had the person using those particular stolen credentials installed or looked at? What data had been accessed via the fraudulent domains? It also meant that the investigators could be relatively confident the incident was confined to a particular department or target system and that wiping and restoring those systems would be sufficient to remove the intruders’ presence. For instance, to breach OPM, the intruders stole contractor credentials and registered the domain so that their connections to OPM servers would look less suspicious coming from that address. Equifax, Sony Pictures, and OPM are all examples of computer systems that were specifically targeted by intruders, even though they used some generic, more widely used pieces of malware. To understand the difference between the SolarWinds compromise and the other high-profile cybersecurity incidents you’ve read about in recent years-Equifax or Sony Pictures or Office of Personnel Management, for instance-it’s important to understand both how the SolarWinds malware was delivered and also how it was then used as a platform for other attacks. That whole time, government and private sector systems will continue to actively be breached because of the malware that was surreptitiously included in updates to the SolarWinds Orion products. In the coming year, we won’t just be fighting about who was responsible or figuring out how this happened or assessing the fallout or repairing affected systems. But the SolarWinds compromise is different. I study the aftermath of cybersecurity incidents, and many large-scale breaches come with drawn-out legal battles and investigations that last for months, or even years, following the initial discovery and disclosure. It launched in the spring of this year, and it will likely last for years. The SolarWinds cyberespionage campaign has apparently targeted a dizzying number of government and private organizations: the State, Commerce, Treasury, Homeland Security, and Energy departments Microsoft the cybersecurity firm FireEye the National Institutes of Health and the city network of Austin, Texas, just to name a few.
0 kommentar(er)
