Here’s a Cyberattack That Shows the Weakest Link for Many Organizations
With October being Cybersecurity Awareness Month, we’ve covered a few topics this month to be aware of from a cybersecurity standpoint, because (as the National Cybersecurity Alliance has promoted), it’s all about awareness to #becybersmart! Here’s one more topic that shows the weakest link for many organizations when it comes to cyberattacks – their own current or former employees and shared passwords.
Kansas Water System Cyberattack
According to The Wichita Eagle, a man named Wyatt Travnichek of the Post Rock Rural Water District in Ellsworth (a rural central Kansas water system which serves about 1,500 customers) pleaded guilty Wednesday to remotely shutting down the plant in March 2019 after a federal prosecutor described how the man told investigators he was “so intoxicated” he didn’t remember anything.
An operator monitoring the plant remotely on March 27, 2019 saw the water plant had gone down. The operator, whose remote access was cut, then drove to the plant and found controls changed and a filter turned off. Investigators traced the actions to Travnichek through his IP address.
Was Travnichek a super-hacker? Nope. Just a former employee who used a shared GoToMyPC account to allow remote access to the system after hours. The system used a shared password to access software that controls the plant and it evidently wasn’t reset when Travnichek resigned in January 2019, over two months earlier.
Travnichek, 22, pleaded guilty in federal court in Topeka to tampering with a public water system and reckless damage to a public computer during unauthorized access. He is set to spend a year in prison under a plea agreement. Formal sentencing is tentatively set for February. He never gave a reason for why he shut the plant off.
Shared Passwords and Former Employees
A recent survey performed by security company Beyond Identity of over 1,000 workers had some startling findings, including:
In addition, more than 1 in 5 employees said they used the same password for their personal bank accounts as they did for work-related accounts. And 14.4% of employees who experienced a data breach of their work account(s) didn’t tell their employer! That’s one reason that the average time to detect and contain a data breach is 280 days!
And these are the people who were willing to admit these things in a survey – the actual number could be quite a bit higher!
It’s Not Just Your Employees
These days, it’s not just employees who have access to your data. Cloud providers do as well. In eDiscovery, that means hosting and managed review providers. Do those outsourcing companies have a password policy for their employees? If so, how do they communicate that policy and train their employees on best practices for managing passwords?
Password policies should include clearly communicated guidelines and mechanisms to protect them, including:
Failure to enforce password policies with your employees and also with your outsourced providers isn’t providing a cybercriminal a “back door” to your system – it’s like providing a key to the front door with an engraved invitation! Make sure you have sound password policies in place to protect that weakest link that leaves your organization vulnerable to cyberattacks. Regardless how much you spend on technology to protect against cyberattacks, if an intoxicated 22-year-old former employee can get into your system and bring it down, it isn’t very secure, is it?