Category: Incident Response

I believe that if NASA had been responsible for the maintenance of the system, they would have written a similar report. I did further digging into reports the Inspector General for NASA has released and overall they seem to be objective and almost like a third party. However, even with seeing these reports, I still have some skepticism that there exists some internal pressure to not completely convey NASA as incompetent or in a more than manageable negative light. Even if NASA were to put forward a report where they were at fault it would most likely be more geared to what they were doing well and include plans of how they aim to resolve the findings. Whereas, in the Cybersecurity Management and Oversight at the Jet Propulsion Laboratory, the Inspector General report creates a negative appearance of JPL and a negligence on their end putting complete fault onto their operations.

Due to there being many major findings that NASA found with JPL, there are many approaches that JPL could take to remediate their issues; however, many will take time to implement and change culture.

For incomplete inventory, this is something that many companies struggle with, but is probably the most important step. If the company does not know what devices it has on its network, then there is no way they can sufficiently defend the network. This can be remedied by using a third party software that collects identifying features of the devices and aggregates them into a single pane of glass.

For segmentation of a network, many companies also struggle with concept as well. There are many companies that have a flat network and once a device connects, it could potentially see everything else connected to that network. One way to remedy this would be to have completely separate networks for the different partner environments. This would allow for devices within certain networks to only see ones that it should. Devices should go through an approval process and require authentication to be on the specific network.

In terms of patching, many companies face this as a culture issue. The best way to combat this is to talk to leadership in different ways that highlight the level of importance patching is. Usually this will include dollar amounts of downtime for patching and potential loss time and money if a vulnerability was exploited due to not patching.

Policy should match practice for accountability and ability to audit the company’s processes. Without policies as an enforcer, the entire company could turn to chaos as some issues may be overlooked or forgotten. Additionally, promises to customers may include these policies and staying in accordance to them. Any falter could be a liability and cause for the other company to sue.

Reference

Final Report – IG-19-022 – Cybersecurity Management and Oversight at the Jet Propulsion Laboratory, Report No. IG-19-022, Office of Inspector General

Incident detection and response can allow for fast finding and triage of events to determine if there is malicious intent behind certain actions that take place on the network. When corporations work with third party vendors or acquire attributes of other businesses, there must exist some level of agreement to cooperate between the businesses. Some companies are able to respond better to incidents due to many factors and this should be taken into account when agreeing to work together. There should be some written agreement between the companies as to what access will be given to the different companies or reporting.

So for an acquisition, there may be some agreement that the company acquiring will be able to have visibility into the other company’s network and devices on the network. However, many third party agreements do not have integration between the networks, so instead there may be requirements that the company must report to each other known incidents they find or there Intrusion Detection System (IDS) must have certain levels met or response times to alerts. Business partners must have a defined agreement to be able to trust these partners as to not be attack vectors and also have a value of image, if one is compromised then the other may be pulled in whether it was actually their side or not.

I do not believe that small businesses must have a mature cyber incident detection and response capabilities within their own organization. However, I am of the opinion that if small companies want to work with these large companies that they should have some form of incident response that allows for finding potential compromises in their network, whether internal or third party. Then they should agree to having the compromise fixed and reporting that to the larger company. Additionally, the larger company should have some way to support the smaller company if requested and denoted in their contract of agreement. I believe that cyber is an area that changes rapidly and many small businesses cannot afford to have a full team dedicated to this area. However, these smaller companies still need to have something in place to account for these potential breaches.

References

United States Senate Committee on Commerce, Science, Transportation.​ A “Kill Chain” Analysis of the 2013 Target Data Breach.​ 2014

If I were designing security for Natanz, I would recommend many things in order to have defense in depth. I would want to implement a network prevention and detection firewall. This would allow for easily blacklisting or whitelisting IP addresses and certain ports. Additionally, I would recommend having an Endpoint Detection and Response (EDR) software implemented on all devices connecting to the internal network to allow for monitoring activity of potential unauthorized or malicious files running. I would also recommend they have a Security Information Event Management Tool (SIEM) in place to collect the logs from the network traffic and the EDR. This will allow a team to observe and have quick response if anything unusual is detected in the environment.

I believe that having an air-gapped system may still be beneficial in some situations. In cases where data should be completely offline from other things this is the best solution. However this would be a very rare case in my opinion. An example would be when writing or testing malware, a team would most likely want to be working in an air grabbed network to avoid the potential infection of other devices.

If a system is not air-gapped and is connected to the internet, then that means there is at least one device that can reach out to through the internet and in turn someone can reach in. I would argue that not being air-gapped is more likely to have a potential breach or attack occur.
I think the best way to detect a compromise of an air-gapped environment would be to have software similar to an EDR installed on each device, however there would need to be a human to check physically on each of the networks to check the EDR to see if there was any attempt of unusual activity on any of the devices. So this wouldn’t allow for a real-time response unless there was a person sitting watching the software constantly.

Usually there is not much a vendor can do to prepare for zero-day attacks. However, I would argue that because these attacks used for Stuxnet were all published before use that Microsoft should have been aware of them. I believe that companies should have a threat hunt team/ person. Part of this team’s role or doled out to a third party, should be to search in publications for compromises that may affect their systems.

References

https://en.wikipedia.org/wiki/Air_gap_%28networking%29#:~:text=Air%20gap%20%28networking%29%20An%20air%20gap%2C%20air%20wall,public%20Internet%20or%20an%20unsecured %20local%20area%20network​.

https://www.wired.com/2011/07/how-digital-detectives-deciphered-stuxnet/ https://spectrum.ieee.org/telecom/security/the-real-story-of-stuxnet

The breach against Yahoo!, included exposing “the usernames, email addresses, phone numbers, birthdates, passwords and security questions/answers for at least 500 million Yahoo accounts” (NLR). This many accounts is a significant exposure and part of the reason the breach was hidden and minimal users were notified.

The company was fined $35 million from the SEC and $80 million from federal class action settlement (NLR). While these are significant amounts of money, I think this is a fair amount. The company was in an interesting place of knowing if they notified users that they would lose customers, but also risked that revenue in the interim and then later getting fined. I’m not sure fines will necessarily ever be effective until they become a large portion of a companies annual revenue, otherwise, they will always just be a slap on the wrist. I think there also needs to be more than fines to hold companies accountable. These types of issues are slowly being addressed in legislation like GDPR and the California Privacy Protection Act.

I do believe that Yahoo! Intentionally tried to cover up the breach. I think the sole fact that the company did not mass contact and inform it’s users of the breach shows that they were trying to hide what was occurring. The company notified 6 people of the millions of the breach. The National Law Review article states how the fines given to Yahoo! were the first time fines have been given to companies due to cyber attacks.This has been a continuing trend with the FTC holding companies accountable for breaches and privacy in general. In addition to fines, the FTC has been able to hold companies accountable for creating and maintaining security response teams.

I believe that Yahoo’s initial decision to not focus password resets was a significant mistake on their part. During the investigation process of determining if a breach has occurred or accounts have been compromised, resetting passwords is usually always a part of that process. Sometimes this is even just a good measure in the process, a “just-in-case”, try to reduce the possibility of if it is undetermined if the account was compromised, then at least a password reset reduces the chance that an attacker will be able to get in again. In this case where Yahoo! knew there were compromised accounts and stolen passwords and still did not force password resets is the epitome of a company not doing their due diligence and potential furthering their users to compromise; like if users use that same account information for other platforms.

References

https://www.natlawreview.com/article/hacked-hacker-hire-lessons-yahoo-data-breaches-so-far https://techcrunch.com/2018/09/06/alex-stamos-facebook-yahoo-security-officer/ https://fortune.com/2016/12/19/yahoo-hack-cyber-security/