Prepared by the ShieldOps team
Oluwadarasimi Isreal
Temitayo Kara
Osumili Felix
Sampson Chinecherem Enyindah
Aderibigbe olalekan emmanuel
Kehinde Justinah Coker
A direct competitor in our industry was recently hit by a ransom-ware attack. The attacker got in through a company computer that had gone unpatched for months and had remote access open to the internet. The company had no way of being informed that the gap still existed until it was too late which caused losses for them. The amount demanded by the attacker was $2.3 million, and the full cost which included recovery time, regulatory fines, and loss of consumer trust will cost way more in the long run.
Before this project, we had the same blind spots. We could not determine how many computers we had, which ones were missing security updates, or whether anything unusual was happening on them. This report shows what we did about that, and where we stand today.
Our Ubuntu server one of two Linux servers we scanned had 86 critical and 536 high-severity security flaws, mostly tied to a badly outdated core system component. In plain terms: this server had well over a hundred known ways in that a determined attacker could have used. Several of them were at the same severity level as the flaw that hit our competitor. Our second server (Kali) came back clean of vulnerabilities but still needs hardening work.
In total we had 88 critical and over 1000 high severity security flaws.
● We built a complete, real-time inventory of every computer in the organization, what it is, what's installed on it or if it is exposed to outside attack or attackers.
● We put continuous monitoring in place so we can track suspicious activity on all computers as it happens in real time, rather than finding out weeks or months later.
● Scanned every computer for known security weaknesses and classified them by how dangerous and how likely they are to be exploited.
● We set deadlines for fixing problems based on how severe it would be, specifying the most dangerous issues must be resolved and closed within the first 24 hours and built a tracking system to continuously monitor so nothing falls through the cracks.
● Verified every fix by re-checking the computer afterward, rather than assuming a fix worked.
● Configured an automatic deployment policy so critical security patches roll out without waiting on a person to trigger them.