3rd Party Risk Management , Critical Infrastructure Security , Cyberwarfare / Nation-state attacks

Report Outlines 10 Years' Worth of Serious Incidents(@Ferguson_Writes) • June 21, 2019    NASA's Jet Propulsion Lab (Image: NASA)

Hackers have repeatedly stolen valuable data - including launch codes and flight trajectories for spacecraft - from NASA's Jet Propulsion Laboratory in recent years, according to a new inspector general audit, which describes weak security practices.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

The audit report released this week by the space agency's Office of Inspector General finds that over the course of 10 years, the Jet Propulsion Laboratory, based in Pasadena, California, has been hacked numerous times, with individuals and nation-state actors stealing data about NASA's critical missions as well as other sensitive and proprietary information.

In 2018, for example, a hacker used a Raspberry Pi computer to access the lab's network, stealing 23 files that contained about 500MB of sensitive NASA data, the report found.

In addition to launch codes and flight trajectories, hackers have attempted to target NASA's research and development on earth science and advanced space technologies, the audit notes.

'Shadow IT' Problems

The report cites several examples of weak security practices. For example, it concludes that the Jet Propulsion Laboratory has a "shadow IT" problem - it does not keep rigorous track of what devices are connected to its network.

The inspector general also found that outside partners and contractors have access to a shared network at the lab, and the lab's IT and security departments do a poor job of segmenting this network to ensure that third parties don't have access to sensitive data.

Simpler times: NASA's Jet Propulsion Lab in the late 1950s (Image: NASA)

"This shortcoming enabled an attacker to gain unauthorized access to JPL's mission network through a compromised external user system," according to the inspector general's summary of a 2018 incident involving the use of a Raspberry Pi.

Other issues the inspector general's report found include:

Problems with NASA's IT ticketing system that helps identify and resolve vulnerabilities in software meant that some critical patches were not applied for over 180 days. The agency does not have a threat-hunting program to aggressively look for threats to its network. NASA's Security Operations Center does not maintain around-the-clock availability of incident responders, and this team does not always follow federal guidelines, such as the those from the National Institute of Standards and Technology, for responding to a cybersecurity incident. The Jet Propulsion Laboratory's has a longstanding contract with the California Institute of Technology, which provides some IT and security management resources. But Caltech's staff did not clearly relay all cybersecurity issues from the lab up through the chain of command at NASA.

In its conclusion, the inspector general recommends a series of improvements, including greater network segmentation to reign in third-party access, greater adherence to federal cybersecurity guidelines and improvement to the ticketing system to ensure vulnerabilities in software are patched faster.

NASA and the Jet Propulsion Laboratory agreed to make nine out of the 10 recommendations that the report laid out. The only improvement that the agency will not make at this time is the creation of a threat-hunting team, the report notes.

10 Years' Worth of Hacks

Nor surprisingly, NASA and its Jet Propulsion Laboratory are a rich target for all kinds of hackers, whether they are working for nation-states or operating on their own, the audit finds.

The agency and its lab not only house a vast amount of data that is targeted by hackers, but NASA's openness to working with third parties and outside researchers - especially those connected with Caltech - means that it leaves itself more open to attack than more closed federal agencies, the report notes.

"The agency's substantial connectivity with nongovernmental educational and research institutions also presents cybercriminals with a larger, more attractive target than most other government agencies and offers cyberattackers multiple points of entry into the agency's various networks," according to the report.

The combination of openness and a lack of adequate controls for which devices and individuals have access to its network led to several incidents at the Jet Propulsion Laboratory between 2008 and 2018, the reports finds. In one 2011 case, hackers gained full access to 18 servers that supported several key NASA mission and stole 87GB worth of data, the inspector general found.

In 2018, an account belonging to an external user was compromised, providing access to a "major mission systems." In this case, the attacker used a Raspberry Pi, a small computer about the size of a credit card, to access the network and take 500MB of data, the report notes.

This particular incident at the lab got the notice of other NASA officials, who were concerned that an attacker could access one network and then move laterally across the entire agency's IT systems, putting mission critical operations in danger, the inspector general notes.

Unauthorized access to the lab's network, coupled with NASA's inability to respond faster, is a significant cause for concern, says Matt Walmsley, a director at Vectra, a San Jose, California-based threat detection and response firm.

"There has been a failing of appropriate policy definition and demonstrable compliance issues," Walmsley says. "There have been technical gaps, which have rendered JPL oblivious to devices connected to their network and left them nearly blind to indicators of active attackers who have defeated access and preventive controls and are now operating inside their network with impunity."

Restoring Trust

Despite the inspector general's issues with Caltech and how it's handled some of the cybersecurity incidents at the Jet Propulsion Laboratory, NASA signed a new, five-year agreement with the university to provide more IT and security services, the report notes.

Ultimately, NASA's leadership must do more to protect the its IT assets and data, the report concludes.

"NASA is responsible for ensuring its IT assets are protected from unauthorized or inappropriate access, including assets on the JPL network managed by Caltech pursuant to NASA's contract with the university," the report states. "Improvements to JPL's security controls and increased oversight by NASA is crucial to ensuring the confidentiality, integrity and availability of agency data."

Cybercrime , Fraud Management & Cybercrime , Governance

Barracuda's Michael Flouton on Social Engineering, Account Takeover and More(euroinfosec) • June 21, 2019     Michael Flouton, vice president of email protection, Barracuda Networks

Ask 10 email users if the use of email as an attack vector has stopped, and all 10 would surely agree: No way. "It's insidious because email just works; these attacks continue to be effective," says Michael Flouton of Barracuda Networks. "And it's really just related to our natural curiosity and humanity's willingness to take risks and click on things and explore new opportunities."

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

But the early days of email attacks - so much noise in the form of malware, spam and links - have given way to attacks that often rely on little more than words, and email gateways often struggle to arrest these types of social engineering ploys, he says.

In a video interview at the recent Infosecurity Europe conference, Flouton discusses:

The growing volume and sophistication of email-based attacks; The latest social engineering and account takeover trends; Best practices for arresting email-borne attacks.

Flouton is vice president of email protection for Barracuda Networks. A security industry veteran with more than 15 years of experience, Flouton previously was vice president of worldwide product marketing for commercial solutions at BAE Systems. He joined BAE Systems through its acquisition of cloud security pioneer SilverSky, where he was vice president of marketing.

Governance , IT Risk Management , Security Operations

Stuart Reed of Nominet on Improving Visibility(@nickster2407) • June 21, 2019     Stuart Reed, vice president, product, Nominet

DNS is cybersecurity's best-kept secret for eliminating threats, says Stuart Reed of Nominet, who explains the value of analyzing traffic.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

"The information within DNS and the anomalies that we are able to see within DNS by applying machine learning techniques ... help reduce the window of compromise," he says.

In a video interview at the recent Infosecurity Europe conference, Reed discusses:

The role of machine learning in mitigating risks; The need to improve visibility; The results of research on the CISO's role.

Reed is vice president, product at Nominet.

Privileged Access Management , Security Operations

BeyondTrust's Karl Lankford on Mitigating the Unmanaged Privilege Threat(euroinfosec) • June 21, 2019     Karl Lankford, director of solutions engineering, EMEA, BeyondTrust

Attackers crave insider-level access to IT infrastructure, and to get it, they regularly target insiders - and especially anyone with "super user" or admin-level access - to steal their credentials, says Karl Lankford of BeyondTrust.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

That's why all insider access to systems must be "managed, monitored and audited" while also ensuring "the principle of least privilege to only give people the access they need at the time they need it," he says.

Putting that in place requires looking at insiders and "scoping some control around what they can do and limiting their exposure once they're through the front door," Lankford says.

In a video interview at the recent Infosecurity Europe conference, Lankford discusses:

His customers' top privileged access management challenges; Best practices for assessing, prioritizing and addressing internal and external privileged risks; Key steps for mitigating the threat posed by unmanaged privileges.

Lankford, director of solutions engineering in EMEA for BeyondTrust, is a frequent speaker at industry conferences.