Five good resolutions for secure IT systems in 2018

Extortion by Hackers

On a Tuesday morning, we receive a call. The caller is the operator of an online shop. He receives several hundred orders daily and also handles payments via this portal. He tells us, shocked, that he has been hacked. He received an email in which the hacker speaks of "serious security problems." As proof, he received extracts from the database and also unencrypted passwords. If he did not pay the ransom of 25 bitcoins (about 100,000 euros at the time), the hacker would sell the data on the darknet. The loss of reputation among his loyal customers is unimaginable.

As a consultancy for information security, we specialize in such cases. We immediately address the incident and carry out so-called Incident Response . It is important to understand what the attacker did, which data they were able to obtain and whether there are multiple entry points. First, we create a backup of the data, which we use to carry out digital forensics. It turns out that massive attacks on the database were carried out over a longer period. In these injection attacks, in addition to personal data, order data and payment information were stolen. Furthermore, the passwords of the shop customers were only protected by an outdated procedure.

We find that the shop has not installed important security updates. Various plugins and custom developments were also integrated into the system, for some of which there are no updates at all. We discuss with the client how the gaps can be closed. We also describe immediate measures in our final report for things that we noticed during the investigation. In addition to filing a criminal complaint, pointing out data protection aspects such as a possible reporting obligation to the state data protection authority and informing affected customers, we suggest measures to secure the shop.

Five good resolutions for the new year

Anyone who wants to avoid becoming a victim of a hacking attack sooner or later must actively care about information security. We therefore present five good resolutions for secure IT systems in 2018.

1. Secure implementation of software projects

Have your software project implemented securely: include requirements for IT security in the project planning , which are implemented by experienced developers. In the case described, correct validation of user input and the use of so-called prepared statements for database queries would have prevented the serious security problem. When standard programs such as content management systems are used, their configuration should be hardened to offer as little attack surface as possible when security vulnerabilities become known. The OWASP Top 10 sensitize to the most common security risks.

2. Installation of updates

Install security-critical updates immediately, not after a few days or even weeks. Especially with standard software like Wordpress or Magento, known vulnerabilities are exploited very quickly. Every software system also has an expiration date after which manufacturers no longer publish updates. Keep this date in mind and ensure an adequate replacement in good time.

3. User management and secure passwords

Ensure secure authentication procedures. If a login can only be secured with a username and password, care should be taken to choose a particularly long password. This should also not be used multiple times for different systems. Better are multi-factor methods, where the user can generate a one-time password via an app in addition to the password. Every user should absolutely have their own access. This allows user rights to be set up so that users can carry out their tasks without problems, but no more.

4. Preparation for emergencies

Be prepared for the worst. These incidents do not necessarily have to be malicious hacking attacks – data loss through unintentional deletion must be dealt with in the same way. Systems can be designed so that hackers can cause only minimal damage. If they managed to penetrate a system, containment must take place and the operator must be informed immediately. Also ensure regular and functioning backups to prevent data loss.

5. Software entails responsibility

Anyone who operates services on the internet must take care of them. In addition to the described updates, log files must be checked regularly to see if an error exists in the application. These files can also be used to recognize whether there are attack attempts on the application. Finally, the system should also be regularly subjected to a security check. Monthly vulnerability scans and so-called penetration tests after significant changes uncover vulnerabilities that can be closed before they are exploited by hackers.

Our client decided not to respond to the ransom demand. Instead, he confidently communicated the incident to his customers and immediately worked on securing the online shop. The state criminal police office has launched investigations. With the introduced security measures, the shop is braced for future hacking attacks.