As a stark reminder of the importance of cybersecurity hygiene, a recent incident involving a state government organisation underscores the critical need for robust security measures.
The organisation fell victim to a data breach due to a compromised employee account, shedding light on vulnerabilities stemming from lax access controls and the absence of multi-factor authentication (MFA).
The breach unfolded when threat actors exploited the credentials of a former employee with administrative privileges (USER1). This lapse in security, a commonly identified issue during cybersecurity assessments, likely occurred because the account wasn’t promptly disabled following the employee’s departure. Thereby proving what cybersecurity auditors usually say that account credentials must be protected at all costs or else it paves the way for breaches.
With access to USER1’s credentials, the attackers infiltrated the organisation’s network, potentially seeking valuable data or additional login information. Evidence suggests that the attackers obtained USER1’s credentials from a separate data breach, emphasising the risks associated with password reuse across platforms. Once inside the network, they accessed two virtualized servers: a SharePoint server and the former employee’s workstation.
Exploiting vulnerabilities within the SharePoint server, the attackers likely obtained credentials for another account (USER2) with higher privileges—global domain administrator access. This escalation granted the attackers control over both the on-premises Active Directory (AD) and the cloud-based Azure AD.
Fortunately, the breach did not extend to the Azure environment, mitigating potential damage to sensitive systems stored there.
Experts at Cybernetic GI emphasise the importance of robust access controls, especially for privileged accounts like the compromised employee account. The significance of MFA as an additional layer of defence against unauthorised access.
Following the breach, the state government organisation swiftly disabled the compromised accounts, disconnected associated servers, and implemented password resets and privilege revocations. However, the absence of MFA for these administrative accounts highlights a critical security gap that could have hindered the attackers’ progress.
This incident serves as a valuable learning experience for organisations across sectors, emphasising the following key takeaways:
1. Promptly disable the accounts of departing employees to prevent unauthorised access.
2. Enforce strong password policies to mitigate the risk of credential compromise.
3. Implement MFA to add an extra layer of protection against unauthorised access.
4. Conduct regular security audits to identify and address vulnerabilities.
5. Develop a well-defined incident response plan for swift and coordinated responses to breaches.
By prioritising these cybersecurity best practices, organisations can significantly reduce the risk of similar attacks, enhancing their overall security posture.
In addition to these, further guidance from the Cybernetic GI Cybersecurity team offers further insights to safeguard networks: Review and minimise administrator accounts to reduce potential targets. Implement the principle of least privilege and enforce MFA for remote access and sensitive data repositories. Maintain asset management and prioritise routine patching to address vulnerabilities. Secure Azure tenants and cloud environments with user permission evaluations and access restrictions.
Overall, this incident underscores the imperative for strong cybersecurity practices. By following recommendations from industry experts and learning from past incidents, organisations can bolster their defences against cyber threats.
To fortify your business against cyber threats, consider scheduling a cybersecurity audit with Cybernetic Global Intelligence. Don’t wait until it’s too late—take proactive steps to safeguard your digital assets today. Contact us to learn more about our cybersecurity auditing services.