The New Employee and the IT Impostor

In the fast-changing world of technology, businesses face increasingly sophisticated threats. This article examines a real-life social engineering attack on a large insurance agency, highlighting the tactics employed by the cybercriminal and the subsequent impact on the company. By analyzing the incident and the measures taken to address it, we aim to shed light on the importance of robust security practices and the lessons learned from this unfortunate event.

Overview of the Incident:
The cybersecurity incident unfolded when a criminal posed as a cybersecurity consultant and contacted the insurance agency, soliciting information about their IT support. The receptionist, unaware of the deception, willingly shared details about the agency’s IT provider and their main contact. Armed with this information, the criminal later targeted a new employee who had recently joined the company. Using the employee’s publicly available information on LinkedIn, including her job details and start date, the attacker gained her trust.

During a lunchtime call, the criminal convinced the inexperienced employee to grant remote access to her computer, claiming to address a “maintenance issue.” The criminal then asked her if she wanted to head out for lunch sinc he wouldneed to use the computer for about an hour anyway. She thanked him and left the office leaving him unattended with remote access to her computer. Seizing the opportunity, the attacker accessed network shares, uploaded information to his cloud storage, planted remote access tools, and deployed ransomware to encrypt files on the network share. Although the ransom was not paid due to the agency’s immutable backup, they did suffer data loss of three days’ worth of information due to an undetected backup failure.

Immediate Consequences and Cost of the Breach:
The agency faced several immediate consequences as a result of the breach. Since personally identifiable information (PII) was accessed on the compromised network share, they had to undertake a digital forensics and incident response (DFIR) project. Additionally, the agency hired a data breach lawyer and incurred significant expenses associated with data breach notification letters sent to all affected individuals.

In terms of costs, let’s consider the following estimates for this breach:

DFIR project: $50,000
Data breach legal counsel: $75,000
Data breach notification for 30,000 records with non-medical PII: $626,750
Additional remediation costs and incident response efforts: $50,000
Total estimated cost: $801,750

Reasons for Changing Managed Service Provider (MSP) to Managed Security Services Provider (MSSP):
This incident prompted the insurance agency to terminate their relationship with the MSP and engage an MSSP that specializes in cybersecurity.

Lack of Identity Verification Protocols: The MSP did not have proper identity verification protocols in place, allowing the hacker to manipulate the employee by impersonating a consultant. An MSSP ensures strict identity verification procedures for all interactions.

Inadequate Application-Based Zero Trust: The MSP did not implement application-based zero trust architecture, which would have prevented unauthorized software installation and restricted access to critical systems. An MSSP prioritizes robust zero trust frameworks.

Insufficient Access Control: The MSP did not enforce proper access control measures, allowing the attacker to exploit the employee’s elevated privileges. An MSSP emphasizes the principle of least privilege to limit access authority and minimize potential damage.

Comprehensive Security Awareness Training: An MSSP provides thorough security awareness training to educate employees about social engineering tactics and the importance of maintaining confidentiality.

Proactive Backup Monitoring and Testing: An MSSP ensures real-time backup monitoring and frequent testing to guarantee the integrity of backups, minimizing the risk of data loss.

Conclusion:
The social engineering attack on the insurance agency serves as a sobering reminder of the importance of robust cybersecurity practices. By learning from this incident, organizations can enhance their security posture and protect themselves against evolving threats. Implementing identity verification protocols, application-based zero trust frameworks, access control measures, comprehensive security awareness training, and proactive backup monitoring can significantly reduce the risk of social engineering attacks and mitigate the potential impact of a breach.

By Derreck Ogden