Tag: security

In the early 2000s, it seemed that many companies were hit with a rash of virus attacks on their networks. Certainly the SQL Slammer worm affected many of us, and it was a memorable week for me. I returned from vacation to get a call late on Sunday night informing me of issues. I spent a long work working with network people and Microsoft to rid our (shut down) network of the worm, a difficult process with a wide deployment of MSDE instances installed in non-standard locations.

Not long after this, we had another virus invade our network and shut down systems. This was due to a high level manager clicking on an attachment in email, which spread issues to (far too) many others inside the company. Another long night for me patching and cleaning systems, and one where I questioned how someone could be fooled.

In the last year, a similar rash of incidents have spread around various organizations, this time with ransomware instead of viruses. One Florida city government was hit, with an IT worker being at fault for opening a document they received in email. The result? The city paid a ransom and the employee was fired.

Is this fair? I’ve seen the Twitter mobs and rapid comment trolls condemning and praising both sides. It appears many people rightly think someone clicking on unknown attachments should be fired, while there is no shortage of others that understand that humans get fooled and termination is too harsh.

Personally, I don’t know what to think. While most phishing and spam is poorly written, and I often check headers and easily see these notes for what they are. I have seen some very sophisticated and incredibly deceitful emails that might fool most of us.

If you have a privileged account, you better be really careful about opening any attachments from email. You shouldn’t download pictures by default except from whitelisted senders, and you might even want to stop doing that. Who knows if your co-worker or business partner got fooled.

It’s disconcerting though not unexpected. Perhaps this person was at fault, perhaps it was  mistake. Being fired is never fun, and all of us should be a little worried about this if we’re not careful.

Steve Jones

Listen to the podcast at Libsyn, Stitcher or iTunes.

I wrote recently about an attack on utility companies by crafting a clever email aimed at specific engineers. That could easily happen with software developers and IT pros, which is why I think it pays to be extra cautious when dealing with any communications that come from others. Whether emails appear to be from internal or external users, phishing is a real concern for those of us that have privileged access to systems, and it should continue to be a concern for the foreseeable future.

I ran across an article that talks about some of the defenses that you can implement. Certainly education is key as one person noted in a comment on my previous article. They said their security department sends around pictures of phishing emails. That’s a good idea, but the volume might be overwhelming in today’s heavily probed environments. I think it would be easy for me to make a mistake after seeing too many examples and when I’m expecting some communication from someone and I get a phishing email on that topic. Still, educating users with privileged accounts know this is a regular occurrence is a good idea.

I know in larger companies, there ought to be some group that knows about phishing issues in depth and centralizes information. Having a support channel (email, Slack, whatever) for people to contact when they have questions is a great idea. I know I do sometimes contact my IT group if I’ve gotten something that seems suspicious. Letting some central group manage reports and provide information also allows that group to help keep a list of sites that should be blocked more up to date. If someone is clicking through but there are blocks to prevent access to links, or even communication from trojans, this can mitigate some of the issues.

Perhaps the best idea, however, is to ensure that backups are taking place and restores can be performed. We know this is critical for databases, but other types of data you use might be valuable as well. While I know that my Drop Box and One Drive folders might get hit with ransomware, I also know my subscription allows me to restore older versions, which hopefully would be un-encrypted.

Security is a constant battle, and the criminals continue to come up with new attack techniques, often with success. Ensure you remain vigilant, educated, and help others in your organization to do so as well.

Steve Jones

Listen to the podcast at Libsyn, Stitcher or iTunes.

We know that the online world is dangerous, with the number and variety of threats constantly increasing. For years, phishing with email has been a favorite tactic of hackers. Most of these emails are poorly written, and IT professionals often spot the fake ones, but there are times when the creativity of nefarious individuals is quite surprising.

There was an attack on utility companies recently, which targeted engineers and purported to have some results for professional examinations. Since there is likely always someone taking an engineering exam as a professional at a utility company, this attack has a chance of succeeding. A Word doc included had a number of macros that installed a trojan for the employee. Hopefully few people allowed macro execution, but I’m sure someone was distracted, busy, and perhaps stressed about their exam results and didn’t think. Or clicked too fast.

What is scary here is that the attack is suspected to be the work of a nation-state, which could mean substantial resources went into the attack. There are certainly potential issues if someone gets access to a privileged workstation, which is always a concern. This is why few people should have privileged access, and a privileged account should never be used for email software. A low-access account is the best way to work through emails and attachments.

Many of us have privileged accounts, but imagine that someone gets a trojan on our laptop. When we use sudo or runas, we might find our credentials compromised. Think it can’t happen? What if all your IT staff got a note about an MS examination result? Or what if they got a free offer to take a certification test? I’m sure someone would click on it, and it only takes one.

Security is hard, with education and caution being the most important tools at our disposal. Spread the word about stories like this and ensure all your staff, especially junior staff, is especially cautious about how and where they open any potential email attachments, click links, or even allow pictures. Security remains a challenge for all our organizations and we need to continually work at maintaining a vigilant environment.

Steve Jones

Listen to the podcast at Libsyn, Stitcher or iTunes.