As several outlets are reporting today, Deloitte, a “big four” accounting firm, has confirmed that its internal email systems were breached. It’s believed that the breach may have been ongoing since 2016. IT security experts commented below.
John Gunn, CMO at VASCO Data Security:
“The massive breaches of credit card numbers and social security numbers is contributing to a devaluation of these items. What we will see now is a continuing rise in attacks on other sources of confidential data that can profit attackers. This was first evidenced with the successful attack on newswire services that yielded hackers more than a $100 million of insider-trading profits, and more recently with the successful breach of the SEC for confidential information on publicly-traded companies. Firms such as Deloitte, that have troves of sensitive, non-public information, that could be used for illegal trading activity will find themselves increasingly in the cross-hairs of sophisticated hacking organizations.”
William Leichter, VP of Marketing at Virsec Systems:
“Cyberattacks are part of everyday life for most organizations. The key question is not whether you get hacked, or even whether you have vulnerabilities. What’s critical is to react quickly and close the window of opportunity to limit damage. If Deloitte had setup a security system for a client that didn’t detect a breach in more than 6 months, they would be fired, or worse.”
,
,
Stephen Burke, Founder & CEO at Cyber Risk Aware:
“A breach like this reinforces the need that every company should operate under the assumption that it is not a question of “if” but “when” a cyber incident will occur.
Deloitte, like the other BIG 4 and any consultancy firms are a big third party risk for their clients. The risk is pronounced owing to the data that their clients entrust with them as part of audits, RFP’s and consultancy engagements.
In relation to what appears to be how they got the data, impersonating a highly privileged email administrator having obtained their username and password, highlights very bad practice by the admin team and ultimately by the internal audit and security team who should have spotted this weakness in their controls.
Every company must realise that all highly privileged accounts are the most sought after accounts any cyber-criminal goes after as they literally offer the “keys to the kingdom”.
Why on earth they did not have two factor authentication (2FA) in place for email admin accounts beggars belief – this attack may not have been 100% preventable but with 2FA it would be a lot more difficult to carry out. So if you know it is a crown jewel, you apply more controls such as 2FA and monitor abnormal user behaviour using a SIEM tool where you could see highly privileged accounts being used abnormally and generate an alert.
It is also an interesting development for cyber insurance companies where this is an aggregation of risk and I wonder what claims will arise out of this once the dust settles and the true number of clients affected becomes known.”
Matt Dircks, CEO at Secure Solutions Provider Bomgar:
“The Deloitte breach is the latest example to underscore the critical importance of securing privileged access. According to Brian Krebs, all administrator accounts and the company’s entire internal email system were compromised in the hack, which dates back to at least the fall of 2016. These administrator, or privileged, accounts are commonly targeted as they are effectively the keys to the kingdom for a hacker to gain access to and move laterally within a network, often undetected.
Companies simply cannot afford to be complacent in the face of these threats. It’s critical that all privileged accounts be secured via multi-factor authentication and strong credential management policies, including frequent rotation of privileged credentials. In addition, companies must employ technology that controls, facilitates, and monitors access to privileged systems and data which can aid significantly in detecting intrusion before serious damages occur. Preliminary reports from Krebs and others indicate these three things were not in place at Deloitte. We can only hope that others in the industry heed the fallout from this and other recent breaches and take the necessary steps to protect their privileged information, their customers, and in some cases their careers.”
Stephan Chenette, Co-Founder and CEO at AttackIQ:
“Many of these damaging breaches can be avoided. It is clear that organizations must take a much more proactive approach to testing and validating their security controls. Offensive Defense using attack simulations gives enterprises the visibility of potential protection failures before attackers can capitalize on them.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.