Editor’s note: The digital world can be a scary place. Whether you’re lurking in the shadow of the dark web or hiding in sight, cyber ghosts are out to trick and scare you with no goodies in sight. It’s no coincidence that National Cybersecurity Awareness Month and Halloween have a common place on the calendar.
In the spirit of the season, we sat down with Bryan Murphy, Director of Consulting Services at CyberArk and head of our remediation services team. With more than 20 years of cybersecurity * experience, Bryan has seen or read almost every threat and grave data breach imaginable. Here he describes some of the stories, trends, and risky practices that keep him up at night. Read on … if you dare.
I was working on a large server build project once. The team used a default password that I had guessed without even wanting to when describing an example of a login scenario. Note that a company-related acronym or stock symbol plus “123” is not a secure password. If you think adding a simple exclamation mark to the end will save your administrator accounts and servers from impending doom, think again. And remember, reviving the ghosts of past passwords for reuse or using the same passwords on multiple systems will surely haunt you.
A perfect storm is brewing
Last spring, many people thought that cutting out commutes and working from home would give them more time to focus on other tasks – like family, friends, hobbies, or even exercise. Reality quickly set in as schools closed, responsibilities shifted or increased, and life in many ways became even more hectic than before. When the FBI reported a 400% increase in cyber attacks, including targeted hits on remote access tools, the company’s security boundaries relaxed and employees adopted risky habits in the name of efficiency and productivity. Today, employees are multitasking like never before – shopping online, home schooling, and domain administration work on corporate systems – all from the same device. It’s like seeing every scary movie cliché at once. What could possibly go wrong?
The masked insider threat
It’s hard to spot a malicious insider in your midst, and even harder when it’s an outsider masquerading as a legitimate employee. Consider the recent Twitter attack in which a motivated external attacker used compromised insider access to gain powerful system access and run a financially motivated social engineering program. Incidents like this remind us that trust is not a security policy and that devils often hide behind angelic costumes. Strong privileged access controls cannot be an afterthought. Embed them in your design process right from the start – actively monitor access – and stop spending your days looking over your shoulder.
When nightmares come true
Increasing attacks on critical infrastructures can paralyze entire cities or arm connected systems. Crippling ransomware attacks force health organizations to make impossible life and death decisions. This fall, a German hospital was hit by a ransomware attack. The resulting failure forced a woman with a life-threatening illness to travel to another facility approximately 20 miles away. She died after a significant delay in treatment. I was asked, “What do we do first? Are you bringing our servers back or turning on the lights in surgery? “Just this week, several federal agencies warned hospitals of” credible “information,” of an increasing and imminent cybercrime threat to US hospitals and healthcare providers, “as COVID-19 cases and hospital stays across the country rise.
No organization can escape the sucker today. There is no silver bullet. Fortunately, many of the risks we face can be eliminated by staying vigilant and following basic security practices such as patching software, securing privileged credentials and identities, enforcing the least privilege, and securing data. Remember, cybersecurity is a journey, not a final destination, and you don’t have to go it alone.
Stay out there safe and keep fighting the good fight. Happy Halloween.
* Note that these experiences are personal anecdotes, reflecting examples gathered during Bryan’s career and are not limited to his work at CyberArk
*** This is a CyberArk blog syndicated by Security Bloggers Network and written by Bryan Murphy. Read the original post at: https://www.cyberark.com/blog/cybersecurity-horror-stories-that-make-us-scream-with-fright/