Lessons Learnt from the Uber Data Breach

 

I stumbled on the news about the massive data breach suffered by Uber last week Thursday. The attack was attributed to the notorious Lapsus$ hacking group, which has been increasingly active in recent months. Researchers say the incident has highlighted the risks that can come from trusting too much in multifactor authentication (MFA), as well as unmanaged risk around cloud-service adoption.

 

One well-known tactic that the Lapsus$ hacking group has been known to use is co-opt MFA-circumventing tools into its attack chain. In a statement released by Uber yesterday said the attacker who breached its network last week had first obtained the VPN credentials of an external contractor, likely by purchasing them on the Dark Web. The attacker then repeatedly tried to log in to the Uber account using the illegally obtained credentials, prompting a two-factor login approval request each time.

 

Sadly unfortunate, this can happen to any organization, thus instead of playing the blame-game, it is important to focus our lens on learning how to protect against such attack scenarios for our various organization. Here is what experts think should be done.

 

-       Reet Kaur, a Board Member and Advisor to Cisco highlights the following as controls to be taken:

a. Implement #zerotrust (ZT) - ZT can address these types of attacks by authenticating every transaction.

b. Enable #redteam / #pentesters to test like a real hacker - Uber has a great pentest team, but most security #teams are asked to play offense but in a restricted way so that operations don’t get impacted. A hacker would have no such limitation. Will you like hacker to test it for you or your team?

c. Security controls do fail, so implement multiple - Security is a #people #processes and #technology play. Implement security controls at multiple layers so that if one control plane fails, another one protects. Continue providing #training to employees but don’t expect flawless execution from them all the time as security is only 1 % of their job responsibilities and mistakes may happen.

d. Implement #changemanagement | Separation of Duties | Dual Control - This is to make sure that NO ONE privilege account can disable critical implementations like MFA without going through proper verifications and approvals.

e. Set exhaustion limits on MFA - Failed attempts for more than 5-6 times should disable the account & require call back to enable the account which may reduce risk of MFA getting compromised. 

f. Implement CASB and #cloudsecurity posture management solutions - It is easy to drift out of compliance if you don’t have full visibility into the cloud. Implementing automated monitoring, detection and response can help get an alert or automatically deny unapproved policy changes.

g. Plan for out-of-band #communication - In case your internal communication channels (Slack) get breached. 

 

In addition to the above, Patrick Tiquet, vice president of security and architecture at Keeper Security, says the Uber attack highlights a fundamental misconception around MFA's strength as a method to secure access. "Use of SMS text messages as MFA should be discouraged and never used as MFA for high-value assets," Tiquet says. "The use of an authenticator app, security key, or biometrics are stronger and more effective methods to protect your accounts." 

 

Although, some organizations may have implemented these controls however, it is pivotal to ensure we stay ahead with these multiple strategies in order to avoid being outplaced by the sprawling complexity of modern threats and the actors.

 

 

7 Things Great Leaders Do to Be Courageous

 I learnt bad leadership is usually in part a result of fear. Here are some concrete ways to get beyond it. Here are seven practices of great leadership that you can adopt to begin changing everything.

Embrace the intelligence of the team

Smart leaders recognize that no one can know everything. Instead, they look for and welcome intelligence in team members. You want a variety of experiences and bodies of knowledge to bring to bear on the organization's goals. Encourage people to be smart and active in planning and execution.

Give people authority and responsibility

You can't know everything and you can't do everything. Micromanagement never makes sense when you can train people and then depend on them. Team members need responsibility to grow and have a good relationship to the organization and they need the authority to undertake the responsibility.

Make most of your job to help others

You lose nothing when you help others shine. You may not take the bows every time, and that's fine. It's like being a good parent. Your children will grow into adulthood and responsibility, and yet everyone knows it would have been impossible without your help. Enjoying the satisfaction of enabling the best in others is part of being a true grownup.

Keep an eye on something bigger than you

Fear is strongest when you focus on yourself. Every difficult and setback gets tied into your sense of yourself. Of course you will be scared because problems get wrongly turned into attacks on your very existence. Get the focus on something bigger and more important than yourself, like the goals of the organization and principles of being a good leader.

Remember goals enable means

We usually think of means in relationship to goals. You create and steer an organization to achieve the end. But you can also think of goals as what enable means. You want your team to do great things. If you achieve a big goal, were you planning to dissolve your company? Probably not. Goals become reasons for the people in the organization to thrive and work together.

Love the process more than the results

As part of enabling the means, enjoy the process. The true pleasure of leadership isn't in the results, because their importance will always pass, but in the process of working toward achievement. You oversee and are responsible for a thriving community, and success comes in its everyday management and cultivation. When you don't get the results, go back to the process and find what needs to happen differently.

Recognize that mistakes are essential

Fear of mistakes comes with fear of failure. However, you need mistakes if you're to do the real job of leadership and help improve the organization. Find problems through the evidence of mistakes, work with the team to fix them, and then keep moving on. Where's the fun if everything goes right?