ORLANDO, Fla.–Technology execs were given a top 10 list of things that are making life even easier for hackers in penetrating credit union systems.
During the joint meeting of the CUNA Operations, Sales and Service Council and the CUNA Technology Council here, David Anderson of CliftonLarsonAllen, Minneapolis, shared the 10 ways credit unions are inadvertently making it easy for hackers to break into their systems and steal information and other data. Anderson said he drew the list from experiences and insights gathered over the last three years as he and CliftonLarsonAllen performed audits at financial institutions.
Below is his list, followed by any comments made.
1. Giving Users Local Admin Privileges
“Time and time again the most common way we are able to elevate privileges and take an attack to the next level is taking advantage of a situation where the user has been given admin privileges,” said Anderson. “Organizations have done a pretty good job with principle of least privilege. But as an attacker I just have to find that one system running that solution where the vendor hasn’t updated the admin access. It’s pretty easy to find that system on the network, and once I do the risk from things I can do on that network greatly increases. That puts you in a tough spot. You have to work with your vendors to understand the risks and develop a plan to move forward so you can get software updated so it doesn’t require admin privileges.”
2. Domain Admins Don’t Have Separate User Account
“As an attacker we hunt domain admin accounts. I’m going to try to do anything I can to compromise one of those systems. We see time and time again where an administrator does not have two admin accounts. You should never be browsing the web from that one admin account. You have to keep them separate. Users use, and administrators administrate, and never the two should mix. Anyone who has administrator access on any system should be given two accounts.”
3. Domain Admins Log Into Workstation
“This is where even when they have two user accounts, they still log into their workstation as the administrator. It makes life easy. I’ve been on that side. I want to use single-sign-on. The most common way to gain access to someone’s network is social engineering, email phishing, some targeted spear-phishing. We gain our initial foothold on the network most often through a workstation, not a server. Workstations are usually configured the same way, so it’s easier for us to pivot around the workstation environment. Try to keep your administrators out of the workstation environment.”
4. Weak Passwords
“Time and time again, each and every assessment I go on, I find default credentials somewhere. Every single device on your network has at least one default login. You have printers with web interfaces; you have cameras with a web interface. We commonly find that there are still systems out there that have the vendor default password or a weak, generic password. We’ve seen developers who don’t think about the security aspect of a new VM, for instance. It’s now on your network. We commonly find these temporary systems that are on your networks that have a default password.”
5. Shared passwords.
“The worst examples are this are usually in shared workstations. When that happens, if one workstation is compromised and there is access to that local admin account, it makes it much easier for me as an attacker to begin pivoting to other workstations. We see this in about 95% of organizations we go to. We even see it sometimes in workstations and passwords. As an attacker, if I find a password, I will try that same password in all kinds of places. As IT, we don’t want a billion passwords to remember, so we keep using the same base passwords across the environment. But what happens if one of those dominoes falls? In Windows, there are two common mitigation efforts. Through group policy you can deny network log-ins from local admin accounts. “
6. Poor Patching
“A lot of times it isn’t poor patching for the whole environment, it’s for the systems on the network that haven’t been updated in a while. We often find a one-off system sitting in some closet that you were going to decommission but that you left online, just in case, and then you forgot about it. That’s all we need to find when an attacker is doing reconnaissance on your system. Just a couple of (client) engagements ago I was on this old XP system that hadn’t been patched since 2008. It just makes it really easy.”
7. Unnecessary Ports & Services
“Most systems we see have more ports and services running than are necessary, just for ease of use. (Vendors) want it to be easy for customers to adopt. So a lot of times there are a lot of unnecessary systems open and exposed. You want to turn off the systems that aren’t necessary for that business function. Minimizing footprints goes a long way toward protecting systems, and makes it easier for you to manage.”
8. Weak/No Encryption.
Here it is: getting to latter 2015 and we still see organizations using clear text protocols. Don’t use a standard FTP; use secure FTP. There are encrypted options for every type of communication protocol today.”
9. Vendor Systems
“Take all the other issues and wrap them into one computer and now you have a vendor system. A lot of times that one-off system with all these vulnerabilities is a vendor system. In vendor administration it is huge to understand who is in charge of securing the system. Are they managing encryption? Are they keeping it up to date? You don’t want to put something on your system and then find you can’t update it, as per your contract.”
10. Lack of Security Awareness
“This is the social aspect, targeting the end-user. This is the #1 way to attack an organization. A lot of times there are good controls on the barrier, so we just get the user to open that barrier for us. Continue to help users understand risks and the different ways they can help protect the organization that are important. Get them onboard mentally. Then add technical controls around that.”