Essential Eight security

The threat landscape is continually evolving with adversaries continually looking for ways to infiltrate and extort organisations and individuals.  Some of the more popular attacks currently affecting Australian organisations include:

• Ransomware
  A type of malware that encrypts a victim’s files and demands a ransom payment in exchange for the decryption key.  This threat has been on the rise globally and can severly disrupt business operations and result in financial losses.
• Supply Chain Attacks
  These attacks involve compromising a trusted third-party vendor or supplier to gain unauthorised access to an organisation’s network or systems. Attackers exploit vulnerabilities in the supply chain to infiltrate and exploit target organisations.
• Phishing Attacks
  Phishing is a technique used by adversaries to trick individuals into revealing sensitive information such as login credentials or financial details.  These attacks often occur through fraudulent emails, text messages, or phone calls, where the attackers impersonate legitimate entities.
• Business Email Compromise (BEC)
  These attacks involve an adversary intercepting standard business transactional emails such as invoices, to intercept and impersonate payment transactions. BEC is a large and growing problem that targets organisations of all sizes across every industry globally.

This data breach occurred because Optus did not secure customer information and data online. They used an application programming interface (API) that didn’t require authorisation to access customers’ private and personal information. The person that conducted the cyber-attack on this company requested a ransom amount, or they would leak the data.

Essential Eight Mitigations:
The Essential Eight does not protect against this form of attack.  However, the Information Security Manual (ISM), from which the Essential Eight controls are drawn, contains far reaching security controls that, if implemented, would have aided in this case.  Since the Optus incident, further ISM controls have been defined that address proper securing of APIs and preventing these types of events from occurring again.

Medibank’s information was compromised when cybercriminals targeted an individual with privileged access to this company’s private information. Cybercriminals sold this individual’s information to a bad actor who accessed the information of Medibank’s customers. After that, everyone with insurance through this company experienced a data breach.

Technique used
The Medibank hack began with the theft of credentials belonging to an individual with privileged access to Medibank’s internal systems. These credentials were sold and purchased on the dark web by a bad actor who used them to gain access to Medibank’s internal system.

Once inside, the bad actor identified the location of a customer database and used the stolen privileged credentials to write a script to automate the customer data exfiltration process – a similar data theft mechanism was used in the Optus data breach.

This stolen data was placed into a zip file and extracted through two established backdoors. Medibank’s security team allegedly detected suspicious activity at this point and shut down both backdoors, but not before 200GB of customer data was stolen,

9.7 million Medibank customers were impacted by the breach. Compromised records include:

• Names
• Birth dates
• Passport numbers
• Information on Medicare claims

Essential Eight Mitigations
A number of controls in the Essential Eight will prevent against this type of attack including but not limited to:

• ISM 1387 – Administrative activities are conducted through jump servers.
• ISM 1649 – Just-in-time administration is used for administering systems and applications.
• ISM 1689 – Privileged accounts (excluding local administrator accounts) cannot logon to unprivileged operating environments.
• ISM 1173 – Multi-factor authentication is used to authenticate privileged users of systems.

Implementing the Essential Eight provides a strong foundation for improving an organisation’s security posture and reducing the risk of cyber-attacks. However, it’s essential to understand that no security measure can offer complete protection. A holistic approach to cyber security that includes employee education, incident response planning, and ongoing monitoring is crucial in the ever-evolving cyber threat landscape.