Death by a Thousand Paper Cuts – The Daily Slog

The word “hero” gets thrown around a lot, but not usually for your average Network Administrator. However, if people knew how much work it truly takes to keep your corporate network humming along (securely, of course), there would probably be a national holiday. Maybe even a parade.

While you might not get the appreciation from the general public you deserve, Portnox has your back – we’ve created a new tool called Switch Commander to make everyday network administration tasks a little bit easier. Now you have one easy-to-use UI that covers all your switches.

And the best part – this tool is FREE! No trials, no credit card needed-just download it and become the commander of all your switches.

Vendor Agnostic

With Switch Commander, all you have to do is add your switch – we support SNMP v1/v2 and v3, Telnet, SSH, and HTTP/S logins. Once you’ve added all your devices, you can do simple daily administrative tasks like assigning ports to specific VLANs or seeing the status of all ports on the switch. The awesome thing is you don’t have to worry about command syntax – if your network is a combination of several different vendors (like 81% of the users we surveyed), you won’t have to remember if it’s shutdown, disable, or no power.

Getting Started with Switch Monitoring & Management

So, now that you’ve got your switches added – what can you do?

A good place to start is the Probe command – this will download all information from the switch and show it to you in a table format (the probe results are shown in the white area on the left in the screenshot above). You can see all ports, including their associated VLAN ID, and the MAC address of what is connected to them.

The Output panel (on right-hand side of the screenshot below) will show you a detailed overview of actions performed on the switch, and the Action panel shows the OID commands executed on the switch when an action is performed. This is super helpful if you’re using an SNMP-based switch monitoring system and need to see if a particular OID is supported.

From here you can enable or disable a port and set or change the VLAN.

Least Privileged, Most Useful

Another huge advantage is that once you’ve added in your switches, you can give other IT staff access to Switch Commander without having to give them credentials to the switches themselves. The login information for each device is encrypted and stored in the Switch Commander database, which has its own separate login. Now it’s safe to have your junior admin turn ports on and off or move VLANs around without them having the keys to the whole kingdom. You can also filter results so that one switch that has 10,000 ports isn’t so cumbersome to search through.

Lookin’ Fancy!

Look, if you have to stare at a screen all day, the least you can do is make it look nice with your favorite colors, right? And maybe throw on dark mode when it feels like your eyes just need a break from super bright white backgrounds! Well, Switch Commander has several different themes and skins you can choose from, so you can customize the look and feel to how you want it without burning your retinas.

Switch Monitoring & Management with Switch Commander

Doing basic network admin tasks on your switches may not save the world, but Switch Commander will save you valuable time keeping your network humming along, and that’s still pretty great. Download Switch Commander for free today and see how easy it can make your regular switch administration tasks.

The principle of least privilege (PoLP) is an information security concept that gives applications or users minimum required network permissions to perform their jobs. Therefore, PoLP is an important aspect of privilege access management (PAM). 

Implementing the principle of least privilege provides network security by avoiding needless exposure. For example, a user and employee access limit reduces the risks of cybercriminals getting hold of critical files. 

Having easy access to the most critical assets of an organization is vitally important. The only users with full access should be the current administrator or the executives in the company. For newly hired personnel within the organization,  the lowest permission levels should be implemented at the onset. Full permissions should be granted  after screening and a background check. Bear in mind that background checks are  always cheaper than data breaches. 

Why is PoLP Important?

Putting the least privilege in place goes beyond having a single or limited number of admins for internal operations. Subsequently, many organizations give users over-privileged access to information that has nothing to do with them. The bitter truth is that half of the users share their credentials with someone else. 

Cyber threats occur inside or outside, and both attackers operate alike. Criminals from outside leverage user account to gain control over endpoints and to acquire targeted access to valuable data. Insiders leverage  the access they have or any compromised accounts. With that, they can leverage data and applications for malicious activities. 

The principle of least privilege ensures that access to critical assets and high-value data gets protected. It applies to not only  just users, but also  to applications, connected devices, and systems that require access as well.  

The principle of least privilege allows the minimum amount of access necessary for employees to complete their job without restriction. It gives a form of balance, keeps systems safe, and facilitates productivity. 

There primary goals of least privilege include:  

• To bring a balance between usability and security protections. 
• To implement a minimum access policy for managing and securing privileged credentials.  
• Flexible controls are needed to balance compliance requirements with cybersecurity, end-user experience, and operational functions. 
• Users only need access to the minimum amount of required privileges. 
• There’s a need to give users a frictionless experience while keeping the system highly secure.  

Key Benefits of Least Privilege

Reducing the Potential for Insider Threats

Cyber actors on the inside use  access to get all accessible data  for exfiltration or destruction. In order to successfully prevent an insider threat, use a comprehensive security policy that contains procedures to prevent and detect misuse. There should also be guidelines for conducting misuse investigations and potential consequences and restricting employee access to  critical infrastructure. There should have a place for locking up sensitive information and isolating high-value systems requiring tight verification access. If necessary,  biometric authentication can be used to prevent  employees from using another staff key card. 

Reducing the Attack Surface

An attack surface refers to all possible points where unauthorized users could gain access to a system and extract data. Organizations with already over-privileged users need to implement the least privilege principle to eliminate unnecessary access. A smaller attack surface is easier to protect. One way to go about it is by determining user roles and privilege levels, to help  understand the particular behaviors of users and employees.  

Limiting Malware Propagation or Infection

The principle of least privilege prevents malware from spreading on a network. Malware often requires local administrator rights to gain access. Meanwhile, an administrator with access to various network resources has the potential to spread malware to others.  

Having fewer users with elevated rights helps in reducing malware infections. In the event of any attack, it becomes easier to contain, thereby preventing the spread to the entire system. In addition, PoLP reduces users’ ability  to install or download unauthorized applications, which can often include malware. 

Increased System Stability

Organizations often have to deal with human errors from within the work environment. For instance, an employee could mistakenly tamper with a file and cause major organizational issues . The principle of least privilege is a great way to prevent high-impact human error and thus guarantee greater network and system stability. 

Applications running with restricted privileges  are  less likely to crash the entire system. PoLP also helps limit the downtime associated with a crash or data breach. As a result, an organization practicing PoLP enjoys more stability, enhanced fault tolerance, and improved work productivity.  

Challenges with PoLP

Implementing the PoLP comes with numerous benefits, though certain roadblocks can impede its full success. These might include: 

Diverse and Complicated Networks

The least privilege comes with the need to centralize accounts to accommodate users and machines. Modern computing environments use numerous complex  platforms – both cloud and on-premise. The implication is multiple endpoints for applications and heterogeneous operating systems. As a result, it becomes quite challenging to guarantee the five most important concerns for the security of an organization’s network.  

These five concerns include the constant protection of networking equipment, security from computer operating system attacks on , preservation of computer hardware , and maintaining data integrity and confidentiality..  

Cloud Computing and Environments

Companies that use cloud environments experience challenges regarding  a lack of segmentation, excess privileges, and account sharing due to cloud-native computing. The misconfigurations that stem from cloud permissions often leave an organization vulnerable to potential cybersecurity attacks. Therefore, implementing the principle of least privilege requires strategies beyond a single tool or product.  

Default Settings Challenges

Operating systems focus more on ease of use than security. Moreover, the software conditions come with default credentials that are easy to find online. These operating systems shy away from enforcing a minimum access policy as default. The implication is that users have the power to carry out actions like creating backups and deleting files. which can negate the principle of least privilege and expose a network to potential attacks. 

How to Implement PoLP

The Implementation of PoLP need not be a complex task. A simple restriction preventing end-users from exfiltrating certain information is a good start. Organizations that want to successfully implement the principle of least privilege can start with the following:  

• Conducting privilege audits by reviewing all existing accounts, programs, and processes to ensure there is no loophole.  
• Starting or converting all accounts to least privilege  to put the necessary checks and balances in place. 
• Organizations can also add privileges based on the access required to perform specific tasks.  
• Separating privileges requires distinguishing between lower-level privilege accounts and higher-level-privilege accounts. 
• Track and trace user or individual employee actions through one-time-use credentials. It goes a long way to avoid potential damage. 

Examples of the Principle of Least Privilege

The principle of least privilege has opportunities for every level of a system. It covers applications, databases, end users, networks, systems, processes, and all other facets of an IT environment. Here are some examples of accounts that need PoLP:   

• User Accounts: The principle of least privilege only gives users or employees the necessary rights for carrying out their tasks or responsibilities. If the user’s computer gets compromised, it limits the lateral spread of that threat. A major challenge arises when an employee has root access privileges, which can cause  
• MySQL Accounts: When several accounts perform unique tasks, a MySQL setup needs to follow the PoLP. When the online setup allows users to sort data, the MySQL account with sorting privileges becomes an issue of compulsion. That way, a hacker who gains access to exploits  only gains the power to sort records. However, there comes a big problem if the account has the power to delete records, as the hacker then has the ability to wipe out the entire database. 
• Just in Time Accounts: Users who rarely need root privileges should only receive reduced privileges the rest of the time. Organizations must make it a policy only to retrieve passwords from a vault when needed. Using disposable credentials equally goes a long way to guarantee cyber security. It serves as a great way to increase the traceability of a network. 

Final Thoughts

Network security best practices call for implementing the principle of least privilege. It serves as  an efficient method for ensuring mission-critical data does not fall into the wrong hands. With such high stakes, it is crucial to learn how to properly implement PoLP  across your organization’s network.

Times are looking more brutal than ever for one of the world’s most critical industries. Ransomware attacks are skyrocketing, and healthcare organizations are increasingly cut off from much-needed cybersecurity insurance.  

But just how bad is the situation? A recent Sophos survey found that 66% of healthcare organizations were hit with a ransomware attack in 2021, up from 34% in 2020. Perhaps more alarming, healthcare organizations pay the ransom most often compared with other sectors (just over 60% compared with a cross-sector average of 46%. So, what’s going on here? Why is healthcare most likely to pay up in ransomware cyber-attacks? 

Why Do Cybercriminals Target Healthcare Organizations?

Healthcare organizations are a lucrative target for cybercriminals because medical records are a treasure trove of sensitive information. The Health Insurance Portability and Accountability Act (HIPAA) classifies various patient information, including Social Security Numbers, contact information, credit card information, and more, as protected health information (PHI). And PHI is one of the most valuable types of data out there.  

Beyond PHI’s higher selling price, healthcare organizations are more likely to be targeted with a ransomware cyber-attack because they’re more likely to pay the ransom. But why? 

Holding Someone’s Life in the Balance

Here’s the bottom line. We all understand why paying the ransom is bad; it feeds the hackers and incentivizes them to continue hacking, making the problem worse for all. However, not paying the ransom isn’t so simple in reality.  

In some industries, data provides a competitive advantage, but in healthcare, losing access to critical data and systems can put patients’ lives in danger. Or in other words, healthcare organizations aren’t blind to the ethical issues with paying ransoms, but getting their services back online quickly is often their top priority. When you consider that the average downtime a company experiences following a ransomware attack is 7-21 days, it’s not hard to see why healthcare companies cave to pressure.  

Medical Devices Can Present an Easy Entry Point for Ransomware Attacks

The healthcare security landscape is made increasingly complex with medical devices and The Internet of Medical Things (IoMT). Medical devices like insulin pumps, wearable biosensors, smart thermometers, and other remote patient monitoring technology play an increasingly vital role in the industry. However, these new devices open up worrying new entry points for attackers.  

As a relatively new industry, IoT still lacks strong security guidelines that help govern and secure other types of tech. At the same time, security is often not the primary concern in the development of new IoT and IoMT devices. Why? Because manufacturers want to maximize functionality while working with limited compute and hardware, which leaves minimal space for robust security and data protection measures.   

More often than not, these devices don’t store patient data. However, attackers can leverage these devices to gain access to other network resources, like a server that does hold sensitive data. Once attackers gain access to the network, they can exfiltrate data or, increasingly, install costly ransomware.   

Beyond IoMT, other complexities of the healthcare IT environment can leave healthcare companies vulnerable to cyber-attacks. For example, the need for efficient and widespread access to critical patient data across systems means two-factor authentication and zero trust defenses aren’t always feasible. 

An Increase in Ransomware Attacks is Making it Harder to Get Cybersecurity Insurance

Ransomware attacks are on the rise, healthcare IT environments are more complex than ever, and the cybersecurity skills gap puts in-house cybersecurity teams under immense pressure. With this dire picture in mind, healthcare organizations increasingly turn to cyber insurance to protect their vital assets and minimize cyber-attack damage. But there’s a problem – obtaining coverage is becoming more challenging.  

The Sophos report found that 51% of respondents said the level of cybersecurity needed to qualify for cyber coverage is now higher than in the past. At the same time, cyber insurance is becoming increasingly expensive.  

Ransomware attacks are a significant cause of changes we’ve seen in the cyber insurance market in recent years. Ransomware is now the largest driver of cyber insurance claims, and with attacks increasing, ransom payouts have soared. As a result, many cyber insurance providers have found themselves unable to keep up and have left the industry altogether. The ones that remain are changing their limits, coverage, and pricing to manage the increased risk.   

This has led to a seller’s market, where the dwindling number of providers hold all the power. They can charge what they want and be selective about who gets coverage. And unfortunately, many healthcare organizations aren’t meeting the selection criteria.  

Equally concerning is threat actors’ monitoring of cyber insurance companies’ relationships. According to Reuters, some ransomware attack check whether potential victims have policies that make them more likely to pay the ransom.  

However, the competitiveness of the cyber insurance market does seem to be having some positive effects. For example, over 95% of healthcare respondents said they have made improvements to their cyber defenses to boost their cyber insurance prospects. For example, nearly half of the covered respondents implemented new security processes and increased staff training.  

Despite the concerns surrounding cyber insurance, it’s crucial that healthcare organizations understand that cyber insurance isn’t a band-aid for weak cybersecurity. Instead, healthcare organizations need to deploy robust cybersecurity defenses that grant a speedy recovery from a cyber-attack, as well as backups and endpoint detection and response solutions.  

Wrapping Up

The healthcare industry has had a tough few years with COVID-19, rising staff shortages, increased demand for telehealth, and a constant onslaught of ransomware attacks. If the healthcare industry wants to lose its number one spot as the industry most likely to pay ransoms, it needs to take a more rigorous approach to cybersecurity. The cybercriminals will stop trying (or trying in colossal numbers) when the work becomes too hard and the reward too low. As it stands, healthcare is the low-hanging fruit for cybercriminals in 2022.