At Your Fingertips

MOREY HABER, CTO, BEYONDTRUST, SHARES INSIGHTS INTO HOW ORGANISATIONS CAN LEVERAGE PAM FOR EFFECTIVE CYBER FORENSICS AND SECURITY BREACH REMEDIATION.

- 

No one wants to respond to a security incident or a breach, particularly at the start of a new year! Instead, the highest priority should be to stop a cyber threat before it compromises the organization. But in reality, preventing a cyber attack from landing is not always possible. The steps for the incident or breach identification - from threat hunting to searching for explicit Indicators of Compromise (IoC)—are well established. While the processes will vary from organization to organization, malware, compromised accounts, lateral movement, etc. will all need to be addressed as a part of any formal clean-up plan.

If a breach is severe enough organizations may have no choice other than to reinstall the entire environment from scratch. While that is a worst-case scenario, it does happen. In many cases, businesses may choose to scrub servers as best as possible versus performing a complete reinstall. That is a business decision based on risk, feasibility, and cost. It also represents a no-win scenario if the threat is a persistent presence that uses techniques to evade traditional identification measures. If you think that is far-fetched, just look at the history of threats like rootkits, Spectre, and Meltdown that prove that there is always a way to attack a technology resource.

Threat actors are after your credentials

Regardless of your remediation strategy, you can be assured that, via some fashion or another, threat actors will have access to your credentials. This implies that any clean-up effort should not reuse any existing passwords or keys. If possible, you should change (rotate) all credentials across every affected or linked resource. This is where Privileged Access Management (PAM) comes into play. The clean-up or redeployment needs to be protected from password reuse or from a threat actor regaining a persistent presence due to poor credential management, as remediation efforts begin.