System administrators with administrative access have significant control and can potentially cause severe damage if unauthorized.
Third-party service providers with access to keys and keycards pose a high risk of unauthorized access and potential spying.
Deep dives
The Power of Administrative Access in the Workplace
The most powerful person in the workplace might not be the CEO or owner, but rather the system administrator who has administrative access to crucial business machinery. With this access, they can control and monitor all aspects of the company's data, emails, files, and network traffic. Unauthorized access to this level of control can be detrimental to a business, making it crucial to ensure the rightful and trusted individuals have administrative access.
The Danger of Unauthorized Personnel with Administrative Access
Unauthorized individuals with administrative access to a company's network can exploit their power in malicious ways. These individuals can bring business operations to a halt, reroute customer payments or paychecks, and gain access to sensitive information. The risks are even higher when considering third-party service providers, such as janitorial services, who may have access to keys and keycards, giving them the opportunity for unauthorized access and potential spying.
Case Study: A Cybersecurity Incident Involving a Managed Service Provider
In a major cybersecurity incident, a Swedish company contracted with a managed service provider (MSP) discovered unauthorized activity on their network. The incident revealed that the MSP had been hacked, compromising not just this customer but potentially hundreds of other clients. The attack involved a sophisticated Advanced Persistent Threat (APT) attributed to nation-state actors, specifically associated with a Chinese intelligence agency. The attackers used the MSP's access to pivot and infiltrate different networks, ultimately targeting the US Department of Defense and stealing sensitive data.
Implications and Mitigation Strategies for Businesses
This incident highlights the need for businesses to be vigilant about their cybersecurity measures. It is crucial to carefully vet and monitor third-party service providers, especially those with administrative access. Implementing strong access controls, regularly reviewing and updating credentials, and conducting thorough cybersecurity assessments can help mitigate the risks. Organizations should also have an incident response plan in place to swiftly respond to and contain any potential breaches.
Fabio Viggiani is an incident responder. In this episode he talks about the story when one of his clients were breached.
Sponsors
Support for this show, and for stretched security teams, comes from SOC.OS. Too many security alerts means alert fatigue for under-resourced SecOps teams. Traditional tools aren’t solving the problem. SOC.OS is the lightweight, cost-effective, and low-maintenance solution for your team. Centralise, enrich, and correlate your security alerts into manageable, prioritised clusters. Get started with an extended 3-month free trial at https://socos.io/darknet.
Support for this show comes from IT Pro TV. Get 65 hours of free training by visiting ITPro.tv/darknet. And use promo code DARKNET.