STE WILLIAMS

Ransomware attacks have continued pummeling US schools, with 11 new school districts — 226 schools — hit since October, while major US cities such as New Orleans and Pensacola gradually recover from attacks this month.

New data due to be published today by security firm Armor shows a total of 72 US school districts or individual educational institutions so far have suffered ransomware attacks this year, which means the number of victimized schools could be at 1,040 to date. Even more unnerving: 11 of those school districts — some 226 schools — have been attacked just since late October.

Those are only the school districts whose ransomware attacks have gone public, and Armor expects the victim head count to rise. Among the 11 school districts hit most recently, just one said it had paid a ransom — Port Neches-Groves Independent School District in Port Neches, Texas — but it has not disclosed publicly the ransom amount. Three of the recent victim school districts — Wood County in Parkersburg, West Virginia; Penn-Harris-Madison in Mishawaka, Indiana; and Claremont Unified School District in Claremont, California — announced they have no plans to pay the ransomware. The remaining seven districts have not shared their plans publicly.

School systems are just behind municipalities when it comes to ransomware attacks, according to Armor’s findings: Cities and municipalities still are the No. 1 victim, with some 82 this year suffering attacks. Healthcare organizations are the third-most hit, with 44 cases this year, and managed service providers and cloud-based providers next in line, with 18 cases, according to the report.

New Orleans, which was hit Friday morning, December 13, by what some security experts say may have been the infamous Ryuk strain of ransomware that has been on a tear this year, today still was operating on a manual basis for many of its services after the city took most of its key services offline and has been in the process of cleaning up and investigating some 4,000 computers in its response to the attack. In a local television interview today posted on the City of New Orleans Twitter page, Mayor Latoya Cantrell said there was no “official ask” of ransom and that the city is in recovery mode and had been preparing for such an attack. She said she’s not sure if it’s related to the attack that hit the state in July, and led to the Louisiana Gov. John Bel Edwards declaring a state of emergency.

Kim LaGrue, the city’s CISO, told news site NOLA.com that the attack appears to have begun with a phishing email, the site reported. The city’s police department is currently unable to run background checks for citizens, and for now is documenting law enforcement incidents manually.

Pensacola reportedly faces a $1 million ransom demand, and city officials are investigating how to handle the ransom response, The Associated Press reported. No official word from the city yet on the strain of malware involved, but some experts reportedly are pointing to the possibility of Maze ransomware.

“With schools, municipalities, and healthcare, the common threat is a very low tolerance for any kind of downtime,” says Chris Hinkley, who heads up Armor’s Threat Resistance Unit (TRU) team. “They are all very tech-dependent, and also serve a lot of people, in most cases with taxpayer money. So there’s a sense of urgency. … Attackers have clued into that and it translates into a higher probability of payment.”

These organizations also often lack security resources and funding to build out strong security infrastructures. Even so, attackers are finding them not only easy to dupe into responding to their phishing lures but also to infect via vulnerable systems that don’t have sufficient detection and prevention layers. What ends up getting them to cough up ransom in some cases is public pressure to get back up and running quickly.

While attackers targeting a less lucrative organization such as a public entity rather than a corporate one may sound counterintuitive, Hinkley says it actually makes sense when it comes to the probability of a ransom payment. “At the end of the day, these [victims] are going to find the money if it means having their data or back or not. You can’t teach these kids if you lose funding, and if you can’t process taxes or issue driver’s licenses, or whatever, you’re going to find the money.”

And the goal of ransomware, of course, is to get paid and hopefully get rich. “The common threat is how much money can we make in the shortest amount of time” and maximize profits, he says.

Security firm Emsisoft calls this wave of ransomware attacks a “crisis” situation. The security firm posted its own data over the weekend, noting that some 948 government agencies, educational institutions, and healthcare organizations in the US have suffered ransomware attacks this year, resulting in some $7.5 billion in costs. In the education sector, it counted 86 universities, colleges, and school districts affected, or some 1,224 schools. Healthcare was No. 1 victim in Emsisoft’s list, with 759 victims, followed by federal, state, and municipal governments with 103 victim agencies.

Interestingly, Armor’s report shows that some school districts now carry cyber insurance policies to help ease the financial burdens of a ransomware attack.

While cyber insurance can provide a cushion for victims, the downside is that it also encourages the attackers who get emboldened by ransom payments, Hinkley notes. “And now they have more funds to go and attack another target,” he says.

Emsisoft in a recent blog posts argues for governments to curb ransom payments. “While a blanket ban may not be practical, government should certainly consider legislating to prevent public agencies paying ransoms when other recovery options are available to them. While this may increase costs initially, it would be less expensive in the longer term,” the company, which is based in New Zealand, said in its post. “It seems bizarrely inconsistent that the U.S. government has a no-concessions policy in relation to human ransoms but places no restrictions whatsoever on data ransoms.”

John Carlin, chair of Morrison and Foerster’s Global Risk and Crisis Management Group, notes that no-pay policies should become standard practice. “It is a difficult decision, but continuing to pay causes the criminal market to surge and will just lead to more attacks,” he says. “If that becomes the policy though, we should support state and localities with additional federal funding and assistance to ensure the best protection against ransomware: resilient systems.”

He says insurers also could provide incentives for “resilience” to ransomware attacks.

Microsoft, meanwhile, also discourages paying ransom. “The most important thing to note is that paying cybercriminals to get a ransomware decryption key provides no guarantee that your encrypted data will be restored,” said Ola Peters, senior cybersecurity consultant with the Microsoft Detection and Response Team, in a new post about ransomware payments.

Schooled by Ransomware
Parkersburg, West Virginia-based Wood County Schools has no plans to pay ransom for an attack that hit the district on November 7, even though it has a cyber insurance policy that could cover some of the costs. Teachers and administrators couldn’t access files, voice-over-IP phones were down, and the school’s automated door system failed to open and close properly.

In Texas, Port Neches-Groves Independent School District decided to pay up an undisclosed ransom to get its files back after a November 12 attack. The school also has cyber insurance. Claremont, California’s school district lost its email and Internet services during a November 21 attack that required all computers to be remediated in the system, and left the district without Internet services as of early December.

Ransomware attackers encrypted a server containing sensitive employee information at Maine’s School Administrative District #6 in Buxton, and it was unclear if the attackers actually pilfered the information as well — Social Security numbers, birth dates, mailing addresses, banking information, and income information.

Other recently hit school districts include Livingston New Jersey School District; Sycamore School District 427 in DeKalb, Illinois; Lincoln County in Brookhaven, Mississippi; San Bernardino City Unified School District in San Bernardino, California; and Las Cruces Public Schools in Las Cruces, New Mexico.

School or municipality size doesn’t matter to the attackers, who sometimes are piggybacking off of cloud application or service providers they’ve infiltrated, experts note. “We’ve seen very big and small cities attacked,” Hinkley notes.

The usual best practices for thwarting ransomware include the requisite offline data backups, whitelisting, behavior monitoring, endpoint protection, and security awareness training and establishing an internal culture of security, according to Armor.

Related Content:

• How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
• 8 Head-Turning Ransomware Attacks to Hit City Governments
• 2019 Online Malware and Threats: A Profile of Today’s Security Posture
• Assessing Cybersecurity Risk in Today’s Enterprise

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Disarming Disinformation.”

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/ransomware-crisis-in-us-schools-more-than-1000-hit-so-far-in-2019/d/d-id/1336634?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The number of distributed denial-of-service (DDoS) attacks rose 86% in the third quarter compared to a year ago, with amplification attacks using the domain name system (DNS) remaining the most popular technique for attacking targets.

DNS amplification attacks accounted for 45% of the attacks, while HTTP floods and TCP SYN attacks accounted for 14% and 7.7%, respectively, according to new data published by network security firm Nexusguard. 

Mobile devices continued to be a significant source of attack traffic, with 41% of attacks coming from mobile gateways and three-quarters of that traffic coming from Apple iOS devices, according to the Nexusguard report. Internet of things (IoT) devices also continue to be compromised and used by attackers, says Tony Miu, Nexusguard’s research manager.

Mobile devices and Internet-of-things (IoT) devices “are particularly vulnerable — in part due to their always-on nature, in part due to insufficient security configurability,” he says, warning that “the amplification of speed, higher bandwidth, and reduced latency offered by 5G will also create a perfect environment for massive DDoS attacks that leverage enormous botnets comprised of PCs, smartphones, and IoT (devices).”

There were no major shifts in the denial-of-service landscape overall: Attacks tend to peak in the first quarter, decreasing every quarter after that, until attacks end the year on a slightly higher note. That trajectory happened in 2018, and appears to be happening this year. The vast majority — 86% — of attacks latest less than 90 minutes, and 90% of attacks involved less than 1 Gbps of data.

DNS DDoS via Apple iOS 

Mobile devices became a significant vector earlier this year. In the first quarter, more than 60% of application attacks — one of three broad classes of denial-of-service attacks — could be traced back to mobile gateways and either came from a mobile device or a computer connected to a mobile device. The latest quarter underscores that mobile devices have become increasingly used in volumetric and amplification attacks — Nexusguard’s other two broad categories — with mobile devices contributing to those attacks as well.

While Apple devices typically do well security-wise compared to Android, Nexusguard found that 31% of all DNS attacks came from Apple devices, versus 10% from Android devices.

“While Apple has done a great job in managing, checking, and maintaining the security of apps available for download at the App Store, we believe there are a considerable number of iOS devices were jailbroken, running unauthorized (and) malicious apps that have not been vetted by the App Store,” says Nexusguard’s Miu. 

Overall, the company saw a steep rise in DNS amplification attacks. While amplification attacks more than doubled since the same quarter in 2018, DNS amplification attacks — which use the relatively large size of DNS responses to inundate a target — jumped by a factor of 48 in popularity. 

The technique gives the attacker a lot of bandwidth for only a little effort, the company stated in its report.

“The target thus receives an enormous amount of responses from the surrounding network infrastructure, resulting in a DDoS attack,” the report said. “Because such a sizable response can be created by a very small request, the attacker can leverage this tactic to amplify attacks with a maximum amplification factor of 54.”

The adoption of DNS security, or DNSSEC, has contributed to that rise, according to Miu. “While it’s true that DNSSEC fixes one problem, it creates another,” he says. “The problem with DNSSEC lies in the exceptionally long responses DNSSEC-enabled servers generate.”

Along with DNS amplification attacks, single-vector attacks have quickly dominated again. Two-thirds of attacks used only a single technique to flood a target. Another 17% used two vectors, either simultaneously or soon after one another, to confuse defenders. The remaining 17% used three or more vectors.

Much of the rise in single vector attacks is because of attackers’ focus on DNS amplification, Miu says.

China, Turkey, the US, and South Korea topped the lists of nations from which attack emanated, accounting for 63% of attacks tracked by Nexusguard in the third quarter. Three networks, one in Turkey, another in China and the lsat in Korea, accounted for almost 40% of attacks. 

Related Content

• DDoS: An Underestimated Threat
• DDoS Attacks Up Sharply in Third Quarter of 2019
• Eight-Hour DDoS Attack Struck AWS Customers
• Mirai-Like Botnet Wages Massive Application-Layer DDoS Attack
• Huge DDoS Attacks Shift Tactics in 2019

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Disarming Disinformation“

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/mobile-devices-account-for-41--of-ddos-attack-traffic/d/d-id/1336635?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A failure by many IoT device manufacturers to follow cryptographic best practices is leaving a high proportion of the devices vulnerable to attack, researchers warn.

Researchers at Keyfactor recently collected some 175 million RSA certificates and keys from the Internet using a proprietary SSL/TLS certificate discovery process and then analyzed the data using a particular mathematical method.

The analysis showed that roughly 435,000 of the RSA certificates analyzed—or roughly 1 in every 172 active certificate—were vulnerable to compromise or attack. A high percentage of the weak certificates belonged to routers, modems, firewalls, and other network devices. Other potentially impacted devices included cars and medical implants.

The problem, according to Keyfactor is the insufficient entropy—or randomness—that is used in generating encryption keys on these devices.

RSA keys enable encrypted communication on the Internet. An RSA key is basically the product of two equally large and random prime numbers, both of which are private. “The security of RSA relies on the inability of another party to determine [the] two randomly chosen prime numbers from which the RSA public key is derived,” Keyfactor researcher Jonathan Kilgallin said in a technical paper presented last week at an IEEE conference on trust and privacy in Los Angeles.

Normally, no two RSA keys should share the same prime factors. But Keyfactor’s research showed about 435,000 certificates had a shared prime factor. This made it relatively easier to apply mathematical techniques to try and derive—or to factor—the entire original RSA key. All it took Keyfactor researchers to crack about 250,000 of the vulnerable certificates was a single virtual machine on Microsoft Azure and an algorithm for detecting shared factors. The total setup cost about $3,000, according to the company.

In contrast, Keyfactor found that only 5 in 100 million certificates signed and issued by trusted certificate authorities—and listed in the publicly accessible Certificate Transparency logs—could be similarly compromised.

A majority of the weak certificates belong to Internet-connected devices such as routers and modems with limited resources on them in terms of processing power, memory, and entropy says Ted Shorter, chief technology officer and co-founder at Keyfactor. “If you ask an IoT device to generate a random number, the result is not always as random as it should be,” Shorter says. “So you get weak keys,” that can be cracked relatively easily.

A Lack of Randomness

A threat actor that is able to derive the private key for an SSL/TLS server certificate can impersonate that device, he says. “If you have the private key, you can pose as the device or endpoint that was compromised,” and intercept any communications to that device, Shorter says. In certain settings—such as within a hospital or with a device installed in an automobile—the consequences of an attacker impersonating a trusted device can be especially dangerous, he says. An attacker could also decrypt any data that might have been encrypted with the compromised key.

Designers of IoT devices need to pay closer attention to the encryption available on their devices. They need to be thinking about how to add entropy to the process so that RSA keys are derived from truly random prime numbers, he says. Meanwhile, customers of IoT devices, especially those in critical sectors, need to ask their vendors about the secure random-number generation capabilities on the devices, Shorter says.

The news should be worrisome, especially to anyone using an IoT-device generated SSL certificate to authenticate connections across untrusted networks, says Craig Young, security researcher at Tripwire.

Young says a quick search of Censys.io—a service for searching for Internet connected devices—shows there are some 124 million self-signed certificates out of about 2.2 billion indexed certificates. Many of these certificates are clearly from devices like cable modems or enterprise wireless access point controllers. “The certificates would commonly be generated on device meaning they are constrained in terms of entropy sources,” Young says.

Worrisome as the threat is, real-world attacks, especially targeted ones, against impacted systems are unlikely, he says. In order to exploit this for a targeted attack, “an attacker must first be lucky enough to find a factor for the key on a targeted system as well as being in a privileged network position to exploit this,” Young says.

Assuming that anyone is in position to collect the necessary data, the actual attack will require the hacker to have enough access to manipulate the data stream. “An individual could do this by spoofing WiFi or even cell tower signals,” but the payout would not seem commiserate with the required work, he says. “In my opinion, if anyone is going to use something like this in the real-world, it would be a signals intelligence outfit working at the behest of a nation.”

Related Content:

• Post-Quantum Crypto Standards Aren’t All About the Math
• Scientists Break Largest Encryption Key Yet with Brute Force
• The Fact and Fiction of Homomorphic Encryption
• Rethinking Enterprise Data Defense

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Disarming Disinformation“

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/iot/weak-crypto-practice-undermining-iot-device-security/d/d-id/1336636?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Breaches at financial services firms were a small percentage of the total breaches in 2019, but they delivered more than 60% of all the records stolen into criminals’ hands. On average, a financial services breach exposed more records than those in healthcare, government, education, or other business incidents.

A new report by Bitglass provides these details along with information such as the $388 average cost per breached financial services record. That number is far in excess of the $183 per record average for the tech sector and especially sobering in light of the more than 100 million individuals affected by breaches.

According to the report, created with data compiled from the Identity Theft Resource Center (ITRC) and the Ponemon institute, only 7% of the data breaches in 2019 occurred in the financial services sector, compared with 43% in general business and 36% in healthcare. Of the breaches in financial services, three-quarters were due to either external hackers or malware, while 6% were the result of insider threats.

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Disarming Disinformation.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/financial-services-breaches-less-common-more-damaging-than-those-in-other-sectors/d/d-id/1336637?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The UK company had been in business only a few months and was already receiving praise from the press, including an article in one well-known publication. But that seeming good luck didn’t last: Within a month, malicious — and false — stories started appearing that said the staffing firm had hired out a woman to work at a strip club. 

The company was the victim of a misinformation campaign. Luckily, the business was fake, part of an experiment run by intelligence firm Recorded Future.

To gauge the effectiveness of commercial disinformation campaigns, Recorded Future sought out services to bolster — or undermine — the fictitious company’s reputation. In less than a month, and for a total of $6,050, the company hired two Russian services to spread disinformation using a surprisingly extensive online infrastructure, ranging from social media accounts to online writers, to spread information, says Roman Sannikov, director of analyst services at Recorded Future. The list of publications in which the services claimed to be able to place stories ran the gamut from fake news sites to a top international news service.

“Companies need to be hyper-aware of what is being said on social media and really try to address any kind of disinformation when they find it,” Sannikov says. “The gist of our research was really how these threat actors use these different types of resources to create an echo chamber of disinformation. And once it gets going, it is much harder to address.”

Beyond Politics
Disinformation has become a major focus in the political arena. In 2018, the US government indicted 13 Russian nationals and three organizations for their efforts — using political advertisements, social media, and e-mail — to sway the 2016 US presidential election.

Yet such campaigns are not just useful in national politics. Disinformation campaigns are enabled and made more efficient by the data collection and capabilities of modern advertising networks. While companies like Cambridge Analytica have pushed the boundaries too far, even the legal abilities of advertising networks can be used to do great harm.

“The targeting models that have allowed advertisers to reach new audiences are being abused by these hucksters that are trying to spread false narratives,” says Sean Sposito, senior analyst for cybersecurity at Javelin Strategy Research. “The advertising industry has built a great infrastructure for targeting, but it’s also a great channel to subvert for disinformation.”

Disinformation has already harmed companies. In 2018, members of the beauty community revealed that influencers paid to promote a company’s products had been paid extra money to criticize competitors’ products. The Securities and Exchange Commission (SEC) has filed numerous charges against hedge funds and stock manipulators for taking short positions on particular firms and then spreading false information about the firm. In September 2018, for example, the SEC charged Lemelson Capital Management LLC and its principal, Gregory Lemelson, with such an attack against San Diego-based Ligand Pharmaceuticals.

At the RSA Conference in 2019, Cisco chief security and trust officer John N. Stewart warned that disinformation did not just matter to elections, but to businesses as well. “Disinformation is being used as a tool to influence people—and it’s working,” Stewart said.

Even true information, if put within a specific narrative, can harm companies as well. The portrayal of Kaspersky as a firm beholden to Russia and of Chinese technology giant Huawei as a national security risk has had significant impacts on both those companies.

So how can companies prevent disinformation from affecting them in 2020 and beyond? Experts point to three strategies.

 (Continued on next page)

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/theedge/disarming-disinformation/b/d-id/1336617?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

US entertainment company Rooster Teeth, which creates podcasts and short-form content, is notifying users about a data breach affecting visitors to the Shopify platform of its online store. 

The incident is limited to the e-commerce platform and does not affect Rooster Teeth accounts or FIRST membership subscriptions. On December 2, Rooster Teeth discovered malicious code had been added to its website earlier the same day. Shoppers who visited checkout and entered shipping data were redirected to a spoofed page where they were prompted to enter payment details in order to complete their purchases. Those who submitted data to the spoofed page were redirected back to the legitimate page, where they were asked to fill out the forms again.

Rooster Teeth removed the malicious code from its website and took additional steps to protect the page from further unauthorized access, the company wrote in an email to affected users. It’s alerting everyone who visited the breached checkout process the day of the attack.

In an effort to help protect users’ identities, Rooster Teeth is offering third-party credit monitoring services via Experian for one year to potentially compromised users. It also encourages users to vigilantly watch for fraud by monitoring their personal account statements.

Read the full notice here.  

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “‘Motivating People Who Want the Struggle’: Expert Advice on InfoSec Leadership“

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/rooster-teeth-alerts-customers-to-magecart-attack/d/d-id/1336628?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Question: I need to hire a data protection officer. What should I be looking for in a potential hire?

Tony Anscombe, global security evangelist and industry partnerships ambassador, Eset: The EU’s General Data Protection Regulation (GDPR) requires companies to appoint a data protection officer (DPO). While not a requirement by all legislation, having a person responsible for data protection in an organization does bring ownership and authority to this important task.

What skills should you look for when recruiting a DPO? First, the person must understand the relevant legislation and what constitutes personal information so they can identify where data is being held and ask the crucial questions of why it was collected and whether it still required.

Record-keeping (of audits, risk assessments, data access, monitoring, etc.) requires pragmatism – a key trait in a DPO. Yet this person must strike a balance between a pragmatic approach and also holding authority within the business, as the DPO role is also customer-facing. When consumers request copies or deletion of their data, the right processes need to be in place to deliver or delete as necessary.

Adding to these essential skills is the ability to educate employees on the correct methods for data processing and to educate the business on the reasons to comply. Last, an understanding is necessary of what technology is needed or available to protect the data.

In summary, look for a DPO who is a strong communicator and an independent worker, with legal knowledge and technical background, who can carry credibility and authority within the business.

Tony Anscombe is the Global Security Evangelist for ESET. With over 20 years of security industry experience, Anscombe is an established author, blogger, and speaker on the current threat landscape, security technologies, and products, data protection, privacy and trust, and … View Full Bio

Article source: https://www.darkreading.com/edge/theedge/what-should-i-look-for-in-a-data-protection-officer/b/d-id/1336632?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

SQL Data Discovery Classification, a tool within Microsoft’s SQL Server 2019, could inform attackers which data within a database is labeled sensitive, and which isn’t, researchers report.

Imperva security research engineer Avidan Reich emphasizes this tool does not grant attackers access to sensitive data, nor is this finding a vulnerability in SQL Server 2019. Rather, the research reveals a security issue that exists in the way SQL Data Discovery Classification is designed to work. Microsoft has been informed of the research, released today.

This tool is built into SQL Server Management Studio (SSMS) to let users detect, classify, and report sensitive data stored within their databases. The classification engine first scans a database and identifies which columns hold potentially sensitive information. From there, the tool gives employees a simpler way to apply classification recommendations and manually classify columns, either by SSMS GUI or by SQL statements “Add Sensitivity Classification.”

When the data’s classification state is determined, it’s added to the audit log so employees can better monitor access to sensitive information for compliance and auditing, Reich explains.

There are tools designed to complete this process outside the database, he points out in a blog post on his findings. The “segregation of duties” principle advises a best practice of only giving database administrators the tools they need to do their jobs: designing databases, managing the database, and monitoring its usage and performance. The idea behind this principle is to separate responsibilities so no single employee has access to too much sensitive information.

If organizations adhere to the segregation of duties, this means only security personnel would perform a classification, he explains. An application owner would review and label sensitive data; a security expert would apply the appropriate controls. If a scan is conducted outside the database, the admin is not involved and doesn’t have the opportunity to classify the data.

The issue Reich found with SQL Data Discovery Classification is it shows where sensitive information is stored by labeling it within the database itself. This makes it easier for a malicious insider, or an employee whose credentials have been compromised, to figure out which database columns contain sensitive data and then gain access to it, Reich explains. They would only need the “view any sensitivity classification” permission and a simple query.

“For insider threats, such as malicious employees or employees whose security has been compromised, it would be very easy to use the tool output to access sensitive data under the radar of security tools, such as behavior analytics solutions,” he says. It’s worth noting that database admins and accounts used by applications connecting to the database usually are able to view both nonencrypted and encrypted information.

“Without the tool output, insider threats would have to scan all application tables for sensitive data, which is a noisy approach that can trigger an incident within any behavior analytics security solution,” Reich continues. An attacker who is able to ascertain exactly where valuable data is located can bypass the added step of scanning application tables.

An attacker who holes the server permission Control Server, or the database permission Alter, could also update sensitive data with the label “Drop Sensitivity Classification.” This could render a sensitive column nonsensitive; in doing this, an attacker could make the data accessible under data activity monitoring and behavioral analytics tools.

If your business uses the SQL Data Discovery Classification tool, Reich advises the following mitigation steps:

• Monitor access to the catalog view “sys[.]sensitivity_classifications, which has the location of the sensitive data.
• Monitor executions of SQL statement “Drop Sensitivity Classification,” which deletes the classification label.
• Verify that only authorized accounts can execute the SQL statement “Drop Sensitivity Classification.”

Related Content:

• Assessing Cybersecurity Risk in Today’s Enterprise
• Microsoft Fixes Windows Zero-Day on Lightest Patch Tuesday of 2019
• Rethinking Enterprise Data Defense
• 10 Notable Cybersecurity Acquisitions of 2019, Part 2

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “Disarming Disinformation“

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/application-security/sql-server-2019-tool-tells-attackers-which-data-is-sensitive/d/d-id/1336633?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple