14

Prevent or Mitigate Access Control Attacks

 

Hackers originally gained access to Target’s network by stealing the access credentials, via a phishing attack, of a refrigeration contractor

 

 

Electronic interaction with Target was limited to billing, contract submission, project management

 

 

Sophisticated and prolonged attack at Target

 

 

Once the hackers infiltrated the Target network, they distributed malware to thousands of PoS machines designed to siphon off customer data

 

 

The stolen data was later uploaded from the Target network to an FTP server

 

 

Then, they set up a control server within Target’s internal network that acted as the central repository for the stolen credit card data

 

 

 

 

 

 

 

 

 

 

Requires a coordinated defense involving people, processes and tools that span anti-malware, firewalls, applications, servers, network access controls, intrusion detection and prevention, security event monitoring, and more

 

 

 

 

 

Detective controls

 

 

Access policy

 

 

Automated account reconciliation

 

 

 

 

 

 

 

Occur when a web application authenticates users unsafely, granting access to web clients that lack the appropriate credentials

 

 

 

 

 

Occur when an access control check in the web application is incorrect or missing, allowing users unauthorized access to privileged resources such as databases and files

 

 

 

 

 

Exposing these rich interfaces to anyone on the Internet makes web applications an appealing target for attackers who want to gain access to other users’ data or resources

 

 

 

 

 

Access control attacks attempt to bypass or circumvent access control methods

 

 

Access control begins with identification and authorization

 

 

 

 

 

 

 

Collecting multiple pieces of non-sensitive information and combining, or aggregating, the pieces to learn sensitive information

 

 

 

 

 

Access aggregation attacks that combine multiple tools to identify elements of a system, such as IP addresses, open ports, running services, and operating systems

 

 

 

 

 

Control physical access to systems

 

 

Control electronic access to password files

 

 

Encrypt password files

 

 

Create a strong password policy

 

 

Use password masking

 

 

Deploy multifactor authentication

 

 

Use account lockout controls

 

 

Use last logon notification

 

 

Educate users about security

 

 

Audit access controls

 

 

Actively manage accounts

 

 

Use vulnerability scanners