Call us now:
Identify and Access management and ‘least privilege’ is a back bone to cybersecurity. The breadth and depth of damage reported by MGM follow the cyber attack is consistent with some reports that hacked had access to the firms Active Directory (https://lnkd.in/ekzb43ri), and Oktas release of an advisory late August of threat actors using social engineering to a highly privileged role in Okta (https://lnkd.in/eNUnGNuG).
Threat actors appeared to either have a) passwords to privileged user accounts or b) be able to manipulate the delegated authentication flow via Active Directory (AD) prior to calling the IT service desk at a targeted org, requesting a reset of all MFA factors in the target account. In the case of Okta customers, the threat actor targeted users assigned with Super Administrator permissions.
In a statement ALPHV claim to have been sitting on MGM ‘Okta Agent Services sniffing passwords that couldn’t be cracked from their domain controller hash dumps’. ‘Exploiting vulnerabilities in the Okta agent and superuser admin privileges to Okta and Global Admin to their Azure tenant.’
On what is currently known and if the reports are correct, unauthorized access to Okta is a cause of the recent breaches across 5 firms. It highlights the importance of IAM processes and the management and control AD, AD configuration, security policies and systems monitoring. As the MGM hack appears from the outside to have led to access to the companies ‘crown jewels’, that no ‘reasonable investor’ is going to consider immaterial.
In ones experience time and again one sees hackers focus on AD, that once compromised, the estate is invariably theirs.
Ted Dziekanowski Rachel V. Rose, JD, MBA Bob Dix
#cybersecurity #cyberriskmanagement #cyberattack #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7110162208126300160