Security Think Tank: Your path to understanding attack paths

The complexity of corporate IT systems has grown significantly in the past 10 years, first with the move from fixed on-premise systems to the cloud, and latterly with the growth of web apps and cloud-based services providing new more efficient ways of doing business.

While some smaller organisations may be fully cloud-based, the vast majority of organisations have a mix of on-premise IT, cloud or hybrid cloud, and use third-party systems and web apps for internal or customer-facing services.

While this has provided a significant increase in capability and efficiency, it has also brought complexity, both technically and organisationally, with external parties such as cloud service providers and developers having security responsibilities for the software or services they provide.

Over the same period, attackers have become more sophisticated, with targeted attacks typically using several vulnerabilities to gain a foothold, escalate their privileges, then move to other hosts and servers within the network.

There will then be yet more exploitation of vulnerabilities to maintain persistence – these vulnerabilities will not just be software vulnerabilities, but could be errors in cloud configuration or identity and access management (IAM), or could be the result of a supply chain attack on a software or service provider.

These can be addressed to some extent through vulnerability scanning and automated cloud policy verification applications that check configurations against a high-level policy, but they can never be eliminated.

The MITRE ATT&CK framework identifies nine main techniques that attackers use to gain initial access.

The majority of these – such as web drive-by compromise, exploitation of public-facing apps, external phishing, replication through removable media, use of stolen accounts – will only provide user-level access.

This allows the attacker to access information available to the user, but does not give full access. For this, the attacker needs to exploit a vulnerability to escalate privileges and become an administrator to escape that initial host, and another to gain a foothold on a second host or server.

Similarly, if hosting web applications, exploitation of a vulnerability or misconfiguration in an external-facing web app could give access to an underlying database, or direct access to the operating system and through that to other systems by exploiting other vulnerabilities.

While customer-facing and internal systems should be kept separate, often they are not, and it can be possible to jump from one platform, or system, to another.

The most likely connection will be a common IAM system, particularly if users’ Windows Domain passwords are used across different systems – which is not uncommon. However, if there is any connection between two systems, then poor configuration or unmitigated vulnerabilities could allow an attacker to move between them.

This risk cannot be properly addressed without an accurate inventory of assets and interconnections, which needs to be up to date at all times. 

“If there is any connection between two systems, then poor configuration or unmitigated vulnerabilities could allow an attacker to move between them”