South Staffordshire PLC, parent company of South Staffs Water, a small independent utility that supplies water to 1.6 million customers, including 35,000 businesses, in central England was hit by a cyber attack in mid-August. Shortly after the attack, on August 15th, 2022 South Staffs Water released a statement confirming the attack and stating that the water supply was not compromised and the incident, “has not affected our ability to supply safe water.”
Cisco recently confirmed they were the victim of a data breach in which hackers were able to steal 2.8 GB of data. Although these breaches are nothing new (SolarWinds, Credit Suisse, Twitter, the list goes on…) the Cisco breach is especially concerning because many organizations rely on Cisco products to keep their networks safe.
The hackers were able to successfully compromise an employee’s personal Google account. Since the employee had enabled password syncing via Chrome and had saved their Cisco credentials in their work browser, once the account was compromised the hackers had the first bit of information they needed to break in.
Of course, Cisco has MFA (multi-factor authentication) set up for VPN access, so the hackers then used a combination of MFA Fatigue and Vishing (Voice Phishing) attacks to get the employee to accept a push notification. MFA Fatigue is when they spam your device with Push requests to allow access; if you’ve ever accidentally clicked “OK” when you meant to click “Cancel” you know how easy it can be to get it wrong and it only takes once. And if you didn’t know beforehand this was a method hackers use to get break into a VPN….you might just assume it was a glitch, press OK and move on.
Vishing is when someone calls you and pretends to be from a legitimate business entity to get you to give up personal and/or financial details. Your first thought is likely to be “I would never fall for that” but these bad actors have plenty of information stored on you to convince you that they’re really calling from where they say they are. Such tactics often include number spoofing to impersonate your bank or corporate office, to confirm details like your credit card number and the last four digits of your SSN. Everyone has a story of a “near miss” when they almost clicked on a suspicious link or answered some questions they shouldn’t – it only takes one moment of being too trusting.
From there the hackers went on a whirlwind tour of expanding the systems they could access until they reached a domain controller, downloading all the user data, enrolling other devices for VPN access, creating a new user just called “Z” and adding them to the local administrators group, and installing other hacking and access tools like TeamViewer, LogMeIn, Cobalt Strike, and more.
There is an excellent, detailed write-up here for those interested in a deep dive.
Is there a tool that could have prevented this from happening? If you had a robust NAC solution like Portnox NAC-as-a-Service, would you be safe from this kind of attack? The answer is absolutely, without a doubt…maybe.
ZTNA (Zero-Trust Network Access) is a term that gets thrown around a lot, but this is a perfect example of why it’s so important. It boils down to this: your network should never trust that you are who you say you are. Many people think of VPNs as totally safe, and you’ve probably rolled your eyes a time or two when you had to go through the extra MFA step, but when it comes down to it, you don’t want trust just any device accessing your network, even if the user account is valid (because as we know from the Cisco example, sometimes it simply isn’t.)
So, the best way to prevent a compromised account from accessing your network is to make sure access is limited to only people AND devices you trust.
Without a VPN, this is easy – you can use the MAC address of the device to verify it and block anything that is using an unknown MAC even if the user credentials are valid. When you introduce a VPN, though, it becomes a little trickier, because VPNs use a ‘virtual’ network interface with a completely made-up MAC address.
The best way to accomplish true ZTNA is via user account and certificate validation. Certificate-based authentication is the use of a digital certificate to identify a device before granting access to a network resource (versus granting access to any device when a user account is valid.) Certificates are stored on a specific device, signed by a trusted root certificate authority, and are only good for a set amount of time. Your NAC checks for the certificate to be valid and properly signed when you try to log in, thus verifying both the user account and device. While certificate-based authentication is certainly not new, it is gaining popularity due to closing the gaps left by purely password-based authentication.
There is also a possibility of using ComputerName as a RADIUS Attribute, but the device needs to support additional RADIUS attributes and not all of them do. If your network is comprised of hardware from several different vendors, certificates are the way to go when you need your solution to be truly vendor agnostic.
Users are always the biggest threat to network security, and at the end of the day most of our tools are designed to save us from the people who also need access to internal resources to keep us running.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。
For a long time, companies had data centers as their IT infrastructures, which needed to be protected from external agents.
Business-critical data was embedded in these allocations, including internal networks, client devices, Internet gateways, applications, and servers.
To protect these assets, firewalls, antivirus programs, intrusion systems, and demilitarized zones were used, separating those who had access authorization from those who did not.
In this type of structure, anyone could access most of the network, regardless of their need and the tasks they performed in the company.
On the other hand, accessing it remotely was a major challenge due to the Network Security Perimeter.
The digital transformation process, along with the migration of infrastructures to the cloud and the adoption of remote work models, has led companies to decentralize their infrastructures.
One of the direct consequences of this movement was the development and adoption of Zero Trust-based models and micro-segmentation, since the Network Security Perimeter has become inefficient. In this article, we will explore this subject. To facilitate your reading, we divided our text into topics:
Read our content to the end and understand more about it!
The Network Security Perimeter refers to the model used in traditional networks to protect resources and data and prevent them from being accessed by external invaders.
For this, intrusion detection and prevention systems and firewalls are used, among other security measures. There are three best practices when it comes to Network Security Perimeter, which are:
Some features can be used to promote passive monitoring by detecting vulnerabilities and identifying different devices connected to the network.
Passive monitoring allows one to locate desktops, remote servers, and routers, among others, and assess their configuration and operating system in order to find weaknesses that can be exploited by malicious agents. To do this, one must activate these features or schedule them manually.
Active monitoring makes it possible to map an organization’s private network and check it continuously, identifying irregular traffic, unknown IP, and data transmission, among other patterns.
With active monitoring tools, one can keep employees in compliance with the organization’s guidelines, without exposing the system to security failures due to malicious actions or misuse. They allow you to create logs and reports to audit network security in real-time.
Network zoning divides the areas of a network into secure, restricted, controlled, and uncontrolled zones. Its great benefit is to limit security breaches to the areas where they occurred, without affecting the others.
Each zone has different security policies and traffic can be restricted through firewalls, which leave the identity of the trusted network hidden from untrusted ones that are connected to the Internet.
With the evolution of cloud computing, the Network Security Perimeter has become insufficient to provide cybersecurity to organizations. In the next topic, we explain why.
The digital transformation has brought the possibility of accessing corporate resources from any environment, maintaining the productivity of employees who are in remote work or on a business trip.
This can be very positive, as it ensures availability for customers, whose demands are constantly evolving.
Adapting to digital transformation involves understanding that the security perimeter does not cover just the local network. Today, it is necessary to protect corporate resources accessed from external networks, such as hotels, cafes, or homes of employees and business partners.
For this reason, experts believe the Network Security Perimeter consists of a concept that has become insufficient and obsolete.
This is because the traditional firewall used to consider the activities developed within a strong perimeter to be secure, and the services managed by public cloud providers extrapolate this delimitation and rely on mechanisms that require other security measures.
Digitally transforming a company requires modifying its security model, applying automated controls, detecting violations using the available signals, and applying the principle of least privilege. In addition, the actions performed by users must be constantly verified, regardless of where these users are located. We call this Zero Trust.
Some changes have contributed to making the Network Security Perimeter an obsolete solution. Among them, we can highlight:
The Covid-19 pandemic has caused many organizations to adopt remote work and, as it seems, this type of work may remain.
This changed the way people work: those who settled in an office today access the resources they need from any device, anywhere.
But even before the spread of the coronavirus, the work had already changed for many: although people worked not only at home, they also worked at home.
With the growth of remote work, VPNs were used by companies so that their employees could securely perform their tasks, even far from the office.
Today, they are still useful for enabling secure remote connections, but violations have already shown us that their security model is perimeter-based. That’s why organizations are looking for easier and more secure resources.
Cloud computing is part of the reality of most companies today. As a result, data and resources are no longer stored in network locations and are stored in an external cloud.
In this way, your employees can access information available in the cloud environment from anywhere in the world, which provides much more dynamism to their activities.
However, it is no longer possible to talk about Network Security Perimeter, or delimiting a certain area, since it dissolves in this context.
After noting that the Network Security Perimeter has become insufficient, it is necessary to adhere to other ways of handling network security, and some of them are:
One of the alternatives to the Network Security Perimeter is to migrate to a model based on zero trust, which assumes that one should never trust, but always verify.
Therefore, users and devices must be authenticated and constantly verified each time they access a program or resource through solutions such as SSO or multifactor authentication (MFA).
Thus, users will have access only to the data and tools they need to perform their functions.
This mechanism promotes security because it not only protects the network against external invaders but also against insider threats. At the same time, it favors flexible access to organizational systems, which can be done from any environment.
Micro-segmentation enables the creation of secure areas for companies to segment workloads that must be protected in isolation.
This feature is useful in environments with many assets, such as cloud deployments and data centers, but it is very complex to deploy it securely in large companies with numerous networks, cloud platforms, and firewalls.
To be efficient, micro-segmentation needs to have visibility, something that many networks do not have. This is because engineers must know which devices are on the network to target them.
Created by the Cloud Security Alliance (CSA), the software-defined perimeter (SDP) is a structure that controls access to resources based on user identity. Its function is to allow connection to applications, network systems, and services securely, hiding details of the infrastructure such as IP addresses and port numbers.
In this model, a network device refuses connections from any other device or application that is unnecessary to perform a certain activity, preventing attackers from exploiting the network.
The Internet of Things (IoT) is characterized by making it possible to live in a hyper-connected world, in which everyday objects are connected to the Internet, working together with the minimum of human intervention.
Its evolution generates new vulnerabilities when it comes to information security, since not all people are used to adopting appropriate protection measures.
Preventing technological evolution is impossible, however, it is necessary to reflect that having everything connected anywhere makes the goal of the Network Security Perimeterunfeasible, requiring the adoption of layers of security that do not compromise the business.
We, from senhasegura, are part of the MT4 Tecnologia group, created in 2001, to promote cybersecurity.
We are present in 54 countries, providing our clients with control over privileged actions and data. In this way, we avoid the action of malicious users and data leaks.
We understand that digital sovereignty is a right of all and this goal can only be achieved with applied technology.
Therefore, we follow the life cycle of privileged access management, before, during, and after access, by using machine automation. Among our commitments, the following stand out:
By reading this article, you saw that:
Did you like our article on Network Security Perimeters? Share it with someone who may also be interested in the topic.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.
