Spooky Security Showdown:🚨 Cyber Incident Response Challenge 🚨

Someone has got to be first 🕵👀

Hidden for those who dont want to see any other attempts 👻

Change Admin login password

Set password to a secure password

Setup two factor athentication

Restore network changes

Delete encrypted data

Restore data from backup

Incident Analysis:

Admin password was compromised and someone logged in from outside the network. After several attempts they were able to gain access using the correct password.

High volume of file write operation on Financial data - bad actor is copying, then encrypting financial data files

User “Admin” connected to another external IP address and backed up financial data to off-site location 198.51.100.2 so they can review the information and use it to demand ransom or sell to dark web. 

When user mkim logs in the ransomware alert is triggered and bad actor using admin account logs off

Incident Response Plan:

Change all Admin passwords, and for good measure have all users change passwords immediately to a password with a very secure password requiring at least one upper case letter, at least one lower case letter, at least one number, and special character - password should be more than 8 characters and nothing used anywhere else. 

Set up multi factor authentication

Restore full server from previous good backup

Invest in MDR services to prevent/stop future attempts  

Remove “Admin” account and create a unique name for the admin account such as “ABCcompanyAdmin” so that the user name is not as easy to guess. 

Limit the number of users who have admin level access on the network

Incident Analisys

• On the fourth attempt a user outside the local network gained access to the "admin" account
• The attempts followed each other within a very short period of time (1 sec.).
• The admin user performed a write and modification operation on a large volume of files, with subsequent encryption.
• Soon after, an outbound connection was activated with suspected database backup activity purporting to be directed at the outbound connection for data exfiltration.
• The "mkim" connection revealed the presence of ransomeware for the first time (I think becose mkim adopte Webroot 😁)
• The IT manager is alerted to anomalies The IT manager begins an analysis of network traffic and detects anomalous outgoing traffic to an unknown address.

Incident Response Plan:

• Immediately disconnect the server from the network to stop the flow of data to the outside.
• Run a scan with an antivirus to eliminate any ransomeware present and stop the encryption.
• Immediately change the admin password and adopt password security policies (lowercase letters, uppercase letters, numbers, symbols and a reasonable minimum length of at least 8 characters but at least 12, 15 or more is recommended). With a good password manager this is not a problem.
• Set a rule of maximum number of authentication attempts(ex. 3), after which banning the account for a minimum period of a few hours (this makes a bot give up in a good number of cases).
• Adopt a multifactor authentication system.
• Delete the files compromised by encryption and restore the files from the last available backup copy before the attack. Alternatively, restore the entire server from the last full backup copy available before the attack.
• Replace the admin account with a more personalized and more difficult to identify user (avoid "administrator" or similar), for example "UserADMMyCompanyUnique".
• Put the server back on the network.
• Force all administrators to change passwords to apply password restriction rules to everyone. The number of network administrators should be as limited as possible.
• The password rule must be respected by all users therefore the obligation should be extended to all users.
• The adoption of a good EDR or rather an MDR should be the primary investment for the company

Good responses here!

@tmcmullen  and @Rondolino Cellamare are our winner!

Will PM details for gift card 😉

Congrats @tmcmullen and @Rondolino Cellamare 

A thousand thanks. Too easy to win when you play alone (or almost...)

Congrats!

Too late to compete, but a great idea to use a scenario like this in a company quiz ;-)