Today on our Tech for Business podcast, we're joined by Nate, our Director of Cybersecurity,
and Andrew, our Security Incident Response Team Lead.
October is Cybersecurity Awareness Month, and we'll recap incident scenarios and
proactive measures you can take to prevent them.
This week, we're talking about close calls.
All personal information has been changed to protect confidentiality.
Yeah, so I guess today one of the things that we could maybe just start off talking about
is just some of the close calls that we've seen when it comes to security incidents.
Number one, we'll never say breaches or hacked unless there is an actual compromise breach
or hack.
So through this, one of my first takeaways is please always say security incidents for
whenever you're communicating this type of stuff within your organization because there
may be legal ramifications to that.
But that being said, close calls.
There's a lot of different situations where we see organizations have some type of potential
failure in some of the controls that they put in place to prevent a security incident,
but then also there's maybe a second step that comes into play where it was successful.
And so one of the core concepts of this is defense in depth or security in layers is
there's a reason why you have multiple layers is so that when one potentially fails, you
can maybe catch the threat at a second stage before it becomes a bigger incident.
So while we're going through this, Andrew and I do have some notes here just because
we tend to communicate with customer names.
Obviously, we're not going to do that for the privacy of these organizations.
So we're going to start calling out org one or two or three as we go through this.
But so in org one's situation here, we saw an incident where they did have endpoint detection
response or EDR deployed in their environment.
If you're not familiar with what EDR is, we have podcasts about that, tons of resources,
everything like that.
But they had EDR in place.
And what we saw was one of their users downloaded some type of malicious software on that system.
And what happened at that point was we saw attempts to download additional malicious
software.
And so the software was used to try and download the passwords out of that user's browser.
So then if they are potentially reusing passwords across multiple sites, they could then go log
into there.
So the EDR solution pulled that piece of software out.
They also ripped out software that was designed to dump admin password hashes, which is an
encrypted version of your password on that system, and then use that to log into the
servers.
And in that environment, all of their users had local admin on their system.
So that was an extremely close call to a potential ransomware incident and privileged
escalation.
I believe there was a couple other pieces of software that was associated with it to
try and actually remove the EDR's agent.
And so that was really interesting, seeing that whoever the threat actor was on that
system was actively trying to remove the EDR because it kept removing their software.
And then I think one of the most interesting things was they actually sent an uninstall
request to CIT to try and have us approve the removal of it.
And obviously that was shut down.
And then we completely isolated that device off the network and had them completely re-imaged.
But that's probably one of my favorite close call stories.
It's definitely top there for me as well.
It was funny to see the attacker putting on EDR uninstall applications and seeing those
get ripped out.
So I got a kick out of that looking at the logs after the fact.
Another organization where we had another close call, this second organization, a user
had been receiving many multiple MFA requests.
Got to the point where it annoyed the person enough that they then called the help desk
and we found out that because of MFA, the attacker couldn't get it.
They knew the username, they knew the password, but they kept sending MFA calls and texts
and push notifications and tell it annoyed the person enough to ask why this is happening.
And so that created that alert there.
So one accidental yes, this is me signing in, the attacker would have had access to do
whatever they wanted to do.
So yeah, in that case, the multi-factor was successful, but the user initially failed
by giving up their password in a previous incident or maybe a user password somewhere
along the lines.
It was a compromised password.
The multi-factor helped protect that, but then to give user credit, even though they
failed before, they were also the ones that helped bring light of the situation back to
the IT once they were able to basically rectify the issue in the first place.
And then this is another really interesting one that comes to mind was again, a kind of
third organization here, they had a compromised account.
So it was one of their finance employees that had accidentally fell for a phishing email.
The threat actor was actually sitting in the mailbox because again, they did not have multi-factor
in place.
And so in these cases, the threat actor would sit in the mailbox for any given period of
time.
It might be a day, it could be weeks, we've seen them sit there just for months, monitoring
a mailbox, just laying low, looking at all the emails that are coming through and waiting
for the perfect opportunity.
And so in this case, they went and noticed that a wire transfer hadn't been completed
in quite some time.
And so they reached out and said, sorry, they spun up a domain similar to the customer
and then sent a fraudulent email to them saying, we'd like to pay this or receive these funds
or whatever it was.
Can you please process it to this bank account because that's changed.
The finance individual reached out to their internal IT and said, I'm actually concerned.
I think there's maybe something going on in my mailbox.
And unfortunately, that IT employee completely disregarded that concern and closed out the
ticket in their environment.
And then once they saw that there was a true wire transfer request, they called that company
said, is this legitimate?
And they said, no.
Then they reached out to their IT director who then reached out to CIT for additional
investigation on that.
But again, it was because they had did not have a multi-factor.
So that failed.
The employee, again, they gave up their password and everything like that.
Attacker sat in the mailbox for a long given period of time.
So there was no detection on that mailbox looking for anomalous logins or anything like
that.
So multiple failures along the way.
And then again, the concerns to the IT that was disregarded, that was another failure.
However, because that finance person had the proper procedures in place to validate that
wire transfer, that was a success that made that go from a successful fraudulent wire
transfer to our close call category.
So really interesting.
Wow.
I'm hearing.
So we talked a lot about close calls and I'm hearing a lot of things like MFA and EDR
and this human element.
And as we sort of look at all of these, what is something, what are these key takeaways?
What are the things that customers, and you've covered it a little bit, but what are the
things that the customers and businesses are supposed to be doing so that hopefully this
never happens?
And if it does, they're in this close call category, non-successful.
The one thing I want to add about Nate talking about that earlier with is the defense in
depth.
I like to call it the security onion.
Obers have layers, security has layers, quote from Shrek, I guess.
It's not just one size fits all.
One thing is perfect.
It's going to protect you 100% of the time.
You need to have EDR.
You need to have MFA.
You need to have other solutions in place that are going to layer your defenses because
things fail, users fail.
Users are the last point of defense there.
Using your users, MFA, EDR, those types of things are very important and you can't just
have one single solution.
Ditto.
I agree.
I guess the biggest thing that I have is if you go take a look at the statistics that
get pushed out every single year, the human element accounts for about 90% of all of these
compromises.
As we continue to go through different situations during our cybersecurity month here, continue
to think that there is some type of human element associated with these in most of these
cases.
Sometimes again, the employee has acts like giving up a credential or accepted some type
of multi-factor push even though the tool is in place and they failed that.
Like I had mentioned in that last one, sometimes the human element can also be that last line
of defense like Andrew said, of when the tools and the people failed along the way
or maybe you didn't have a tool in place and everything failed up to that point, they can
be that last line of defense to keep you from having a major security incident because
they are the ones that can at least notify you if a tool didn't notify you already.
So to wrap up today, I'm going to kind of open it up for anything else you'd like to
share and then I'm actually going to ask a little bit of a personal question with all
of these crazy incident scenarios we're going to talk about this month.
Why are you both in this field of work?
Why do you enjoy this type of work?
I'll let you go first, Nate.
I was wondering if you were going to go.
For me personally and something that I've seen at least across our team is that people
who work in the cybersecurity industry tend to have a desire to be a protector.
So think of maybe you're in the armed forces or some type of police officer or something
like that.
You tend to want to help and protect for the most part.
Same thing applies to here is we like to be kind of the guardians of helping reduce risk
to organizations.
We just happen to be really good at technology as well.
And so taking that is we don't want to be the people that are disrupting a business
or trying to impact it too much and say shut everything off.
That's the most secure.
We're trying to keep you moving forward, but there's a passion to keep you protected along
the way and saying yes, you can do that, but let's take additional considerations along
the way.
And then likewise, I think there's also just the human element is having empathy for those
that are going through a very, very stressful situation.
In some of these cases, especially when we get into the true deep ransomware discussions
and everything like that, we've had people crying on the phone with us.
Wire transfers crying on the phone saying, I think I might need to shut down my business.
That's their lifelong work and being able to say you don't need to do that because we'll
get you through it, right?
And being able to successfully keep their businesses afloat.
That is super rewarding.
As far as the reason that I enjoy my job is I'm very interested in how things work, along
with what Nate said, of course, because Nate said the very, very...
I'm a sentimental one, I guess.
I really like to see how things work and how to protect that.
As Nate had mentioned, it's kind of a protective mentality.
It's crazy what people can do without a moral compass.
If some of these attackers just had that moral compass, they would be amazing security professionals.
But because they're incentivized by money or other malicious behaviors, they don't do
it for the right reason.
Thanks to Nate and Andrew for joining us this week.
If you enjoyed this podcast, please like and subscribe.
If you have a question or topic you'd like us to discuss, reach out to us at info at
cIT-net.com or head out to our website, cIT-net.com slash podcast.
And we'll be back next week with more incident scenarios.