Building incident playbooks for machine identity breaches

Publisher excerpt From CSO Online

Pull up your SOC’s compromised account playbook and read through the first 15 minutes. Most SOCs begin their response by calling or messaging the user via Teams to ask whether the 2:00 am sign-in from an unfamiliar country was indeed them. Their subsequent actions depend upon what the user responds with. Try that with a service account, and you’ll be waiting a long time. The same goes for an API key buried in a build pipeline, or an OAuth token somebody granted to a SaaS integration back in 2022 and hasn’t thought about since. Once one of those is stolen, your analysts are running a script that was written with people in mind, and the cracks tend to show well before the first shift handover. There are also far more of them than most boards realise. CyberArk’s research puts machine identities at roughly 82 for every human identity. Very few sit behind MFA, and a fair number hold far more access than the job they were built for. I’d add a problem that gets less airtime, which is that their traffic lives in the background noise your monitoring was tuned to filter out. Where the human playbook stalls Ownership is usually the first thing to slow you down. When a person’s account is compromised, HR can tell you who they are and who their manager is before you’ve finished your coffee. A service account pulling data it shouldn’t comes with no such shortcut, so the analyst burns the first hour working out which team built it. More often than anyone likes to admit, that trail ends at a contractor who left the business a year earlier. Say you do find an owner; containment still isn’t the clean step it is for a person. Lock a user out and one employee loses an afternoon. Pull a credential that a payments integration depends on, though, and you might take a customer-facing service down, which no analyst wants on their name at 11 p.m. without sign-off. So, they go hunting for somebody senior enough to approve the outage while the attacker carries on. Detection is the part people underestimate. An attacker with a valid token makes authenticated calls to the same endpoints the integration hits every day, and a patient one will even keep to its usual hours. Your impossible-travel rules were built around people moving between cities, so they have nothing to compare against here. Figure 1: One alert split into two paths. Ashish Mishra What recent breaches show Cloudflare’s write-up of its Thanksgiving 2023 security incident is worth a quarter of an hour of any CISO’s time. The attackers came in with one access token and three service account credentials lifted during the earlier Okta support breach. Cloudflare had rotated thousands of credentials after Okta, yet missed those four because the team believed, wrongly, that nothing was using them. The alert that finally fired came more than a week after the attackers first logged in, when they added one of those service accounts to an administrator group. Microsoft’s case turned on a test application nobody…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.