Jak ransomware skutecznie przejął setki kontrolerów domen na świecie w jednej firmie? Historia Maersk & notPetya.

Trochę niezręcznie tłumaczyć od deski do deski całe, opasłe opracowanie przygotowane przez jednego z kluczowych pracowników Maersk – tutaj zatem tylko zajawka.

notPetya to rok 2017, a wcześniej (jeśli chodzi o historię zaatakowanej firmy) nasz badacz opisuje grzechy, które można wskazać chyba w większości dużych organizacji – braki z kontrolą uprawnień użytkowników / procesów / usług systemowych. W skrócie: „duże uprawnienia są dobre bo wszystko działa” czy „jak działa, to po co ruszać” ?

Service accounts would frequently be given membership of local administrator groups ‘to make things work’, rather than properly delegated permission. And service accounts would also be shared by multiple applications

In the race to the bottom, security controls had ultimately suffered and become a secondary concern to delivery. With the historical organisational structures within IT, we had multiple security functions but no clear lead, and limited funding. Cue two years of pushing for privileged access controls.

Łatanie, separowanie sieci? To też może mogło poczekać:

Yes, things like network segmentation would help to slow the spread. Things like a SOC would help us see the activity before the fateful day arrived. Patching would absolutely have helped (seriously, if you are waiting to install critical security patches you are doing it wrong). But ultimately, the fundamental risk we had failed to address was management of privileged access.

I poczekało… aż nadeszło średniowiecze IT:

On the 27th June 2017 (almost three years to the day as I post this), the shit hit a really, really big fan.

It appeared some workstations in the office were going dark. Then it transpired no, it wasn’t just our office. Globally devices were going dark. Oh, servers too? Domain Controllers are gone? Oh… We just lost the lot. Within a couple of hours, it was clear this had impacted every single domain-joined Windows laptop, desktop, virtual machine and physical server around the planet. The organisation had just been sent back into the dark ages.

npetya

Chcecie dowiedzieć się jak odbudowano IT w firmie, jak długo to zajęło, co pomogło? Czytajcie dalej.

–ms