News broke today that one of the most popular digital signature services, DocuSign, has fallen victim to a phishing campaign which compromised a database ofcustomer emails. The company has confirmed the data breach after tracking the phishing campaign on May 9.
Andrew Clarke, EMEA Director at One Identity:
“The best defense is a “defense in depth” that starts with user education and includes virus protection, a next generation firewall and ends with a rigorous identity and access management program to ensure that the right users (end users and admins) have only the right access to the right things at the right time. Taken together, security and risk professionals can be assured that their organizations will be more secure tomorrow than they are today.
DocuSign confirmed that a malicious third party gained access to a “separate, non-core system that allows us to communicate service-related announcements to users via email.”
DocuSign don’t actually state how the hackers got into their mailing database but we can assume it was by exploiting or elevating a user’s privilege. Whether the system mentioned is classed as a core or non-core system is up for debate. The wolf in in their perimeter and we can be sure that DocuSign are now running some very rigorous audits on all their systems.
Understanding what your users do have access to rather than what they could or should, is a basic tenet of identity and access management. Once you have this understanding you can put preventative measures in place. If access to a particular system needs to be regulated, then perhaps a full audit and report isn’t enough these days – who reads those reports every hour, daily or even monthly? Being able to spot malicious activity calls for profiling and analytics in real-time. Controlling the perimeter isn’t enough. You must have a clear understanding of what your users can do in your organisation and be able to monitor that, spot the anomalous behaviour and do something about it.
Elevating rights of a user to a generic super user account (i.e. root, dba, domain admins etc.) has to be a process where explicit permission is granted on a “as you need it” process. Asking a manager, as part of a work flow, or multi-factor authentication are great ways to stop these attacks in their tracks. In the case of DocuSign, perhaps the user that fell afoul of an email phish, and was compromised, shouldn’t have had the levels of permission needed to use that database?”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.