I wanted to give you a little example of a real‑life attack that
affected an organization, and we can see how network attacks could
quickly spread from one area to another.
This was a larger retail organization,
you have probably heard of this, with a loss of millions of credit cards.
Let's take a look at an average organizational network.
We have different parts of the company, sales,
finance,
human resources, and operations, and they're all running on a
foundation of information technology being managed by our IT staff.
When we want to connect to the internet, we have a firewall that allows
our traffic to be filtered and controlled.
In this case, the organization installed a building management system,
a heating ventilation and air conditioning unit, and that heating
ventilation/air conditioning unit was installed by a vendor, and the vendor
said could I please have an internet connection to that air conditioning unit
because it'll tell me if there's any problem,
if we need to come in and do some maintenance or repairs.
And the organization said, well, no. We don't mind if you have a
connection that you can connect through the internet, but we don't want
to give you a separate internet connection because that'll be unmonitored
and could possibly even be misused, so instead, we will connect you to
our corporate network. Then all of your traffic will go through our
expensive corporate firewall and we'll be able to ensure that there is no
misuse then of the traffic or the pipeline going to the air conditioning
unit.
Now this sounds good in theory, but the problem is that most IT
administrators don't understand the protocols or languages used by building
management systems, and if I don't understand the language,
it's going to be pretty hard to know if something strange is going on.
I'm not even going to be able to write the rules for the firewall that are
going to be able to filter that traffic effectively,
but it sounds good in theory.
The problem was the vendor came in one day with their laptop to
do some maintenance on the air conditioning unit, and they
didn't realize that their laptop was actually infected, and when
they plugged that laptop in, it now infected the building management system.
The building management system now calls out through its
internet connection through the corporate firewall to a hacker
that is then positioned on the internet.
That attacker now has a direct connection into the organization
and they can converse back and forth through what now is
considered trusted traffic because it was initiated by that
internal system to talk to the hacker.
The hacker is not just isolated to the building management system.
Instead, they have access to the entire network, and that
includes to things like the point‑of‑sale system being
used in sales for this company.
And they can take advantage of the fact that the point‑of‑sale system
put in still had default passwords. Default passwords,
the passwords put in during the original manufacturer of these little payment
card reading devices, and we're all familiar with them.
You go to a store and you want to make a purchase, you insert or you
tap your credit card, that's a point‑of‑sale device.
And it had been installed by a vendor as well, not by the IT department.
And we can see here part of the problem is that we have a building
management system which is definitely not managed by IT, we have
point‑of‑sale devices which are not managed by IT, and yet we're relying on
IT to actually protect the network that these devices communicate on.
Because the hacker knows the default passwords, they were able to install
malware on that point‑of‑sale system. That is now anytime somebody uses a
credit card, it then takes a copy of the credit card number and sends it off
to the hacking group.
Having vendor default passwords is against the
rules of the payment card industry.
The payment card industry says you must not have vendor
default passwords on network‑facing equipment.
But, even the auditors that reviewed this company said that they
were compliant with the rules of PCI, PCI DSS, so this was a
mistake by the auditors who didn't realize that these default
passwords were still there.
In other words, the auditors simply didn't do their job properly.
That resulted in the harvesting of tens of millions of
credit card numbers back to the hacker.
Now, one of the things that IT was involved with was monitoring network traffic.
They had SIEM. We've talked about SIEMs before, a security
information and event management system which is monitoring
many different network devices,
IDSs, IPSs, firewalls, applications, and by monitoring all of these
devices, bringing the data together and aggregating it, it gets to see
a big picture if there's something wrong.
And in this case the SIEM was very good.
The SIEM actually indicated that they had this breach, this
problem, the very first day, but the IT department, quite
simply, didn't know what to do with it.
They didn't understand where the breach was because it wasn't even in
a system that they managed. They were busy with many other things
because it was a busy time period for this retail operation, and so,
therefore, even though this attack had been alerted, they didn't
respond until six weeks later when it was brought to their attention
by law enforcement.
So, this is just an example of something that was
certainly an awful lot more than one mistake.
There were many mistakes that led to this breach, and
unfortunate. For us, there's a lot of lessons to learn.
We can learn to check thoroughly, for example, for default passwords,
incident response,
the alerts that come from our SIEM systems, to make sure that when we
install a piece of equipment such as, for example, a building management
system, it shouldn't just be connected to the corporate network, it
should be connected, but isolated.
And this is something we'll look at actually in the next module of this course,
Network Security Design. There should be segmentation of many of these
types of traffic and network elements so that a breach at one place
does not easily spread to other places.
We know that network security is essential.
Our businesses rely on our networks,
therefore, we need to make them both secure and reliable.