Spring4Shell: Zero-Day Vulnerability in Spring Framework

What Happened?

On March 30, 2022, we received word through our channels of a remote code execution vulnerability in Spring Framework when a Chinese-speaking researcher published a GitHub commit that contained proof-of-concept (PoC) exploit code.

This uploaded exploit targeted a zero-day vulnerability in the Spring Core module of the Spring Framework. Spring is maintained by Spring.io (a subsidiary of VMWare) and is used by many Java-based enterprise software frameworks. The vulnerability in the leaked proof-of-concept, which appeared to allow unauthenticated attackers to execute code on target systems, was exploited quickly.

What Are We Doing?

1. Actively monitoring public data streams pertaining to this situation. We are also researching with Rapid7’s research team who can confirm the zero-day vulnerability is real and provides unauthenticated remote code execution.

Proof-of-concept exploits exist, but it’s currently unclear which real-world applications use the vulnerable functionality. As of March 31, Spring has also confirmed the vulnerability and has released Spring Framework versions 5.3.18 and 5.2.20 to address it.

It affects Spring MVC and Spring WebFlux applications running on JDK 9+. As additional information becomes available, we will evaluate the feasibility of vulnerability checks, attack modules, detections, and Metasploit modules.

While Rapid7 does not have a direct detection in place for this exploit, they do have behavior- based detection mechanisms in place to alert on common follow-on attacker activity.

2. Informing our SOC Analysts of the investigation and providing them with the necessary briefings to deploy any defenses provided by our partners.

3. Reinforcing our recommendations by communicating the need for layered security and applying rock solid standards provided by public vendor neutral agencies like the Center for Internet Security. The goal of these standards is a stronger, robust layering of protective measures for our FIT clients.

What You Can Do

The vulnerability affects SpringMVC and Spring WebFlux applications running on JDK 9+. As of 10AM, EDT March 31, 2022, CVE-2022-22965 has been assigned to this vulnerability.

Spring has confirmed the zero-day vulnerability and has released Spring Framework versions 5.3.18 and 5.2.20 to address it.

https://spring.io/blog/2022/03/31/spring-framework-rce-early-announcement

Evaluate your environment for this vulnerability and patch as needed. We are big fans of the work performed by the Center for Internet Security (CIS). CIS is a nonprofit organization, formed in October 2000.

Its mission is to make the connected world a safer place by developing, validating, and promoting timely best practice solutions that help people, businesses, and governments protect themselves against pervasive cyber threats.

Spring4J would be best mitigated by applying the CIS Controls:

Control 02 – Inventory and Control of Software Assets

Actively manage (inventory, track, and correct) all software (operating systems and applications) on the network so that only authorized software is installed and can execute, and that unauthorized and unmanaged software is found and prevented from installation or execution.

Control 08 – Audit Log Management

Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.

Control 12 – Network Monitoring & Defense

Operate processes and tooling to establish and maintain comprehensive network monitoring and defense against security threats across the enterprise’s network infrastructure and user base.

If you have any questions about how to further implement these controls in your environment, FIT Cybersecurity would love to provide guidance and help you improve your security posture.

 

— The FIT Cyber Team

Serious Cybersecurity Vulnerabilities: Apache Log4j & SMA-3217

UPDATE — 12/18/21

There have been more developments in the ongoing remediation of the Log4j logging library and connected vulnerabilities.

The initial patch, version 2.15.0, that aimed to resolve the remote code execution vulnerability described in CVE-2021-44228 was found to be incomplete and led to the discovery of CVE-2021-45046. Initially thought to be a minor DoS vulnerability, CVE-2021-45046 was assigned a CVSS of 3.7. As of late yesterday, CVE-2021-45046 was elevated to a CVSS of 9 due to newly discovered attack vectors that would allow bad actors to exfiltrate data. A patch was quickly released in version 2.16.0 to remediate it.  Earlier this morning, a new flaw was identified in the patch version 2.16.0 that has required a new patch release (version 2.17.0) and a new vulnerability tracking ID of CVE-2021-45105. The identified flaw is a severe DoS vulnerability that would allow bad actors to perpetrate Denial-of-Service attacks against affected assets. CVE-2021-45105 has been assigned a CVSS of 7.5.

The risk with these vulnerabilities not only rests in active use of the Log4j library within production applications developed by your company, but also in several standard workplace applications and solutions that also utilize it. Log4j is one of the most ubiquitous logging libraries and is used in a plethora of applications and solutions. It is likely that some of the applications you use in your environment are affected and therefore vulnerable. These are called nested vulnerabilities as they stem from a utility that is used within standardly deployed applications and are dependent on patch releases from the vendor to remediate.

 

FIT’s Response:

FIT is continuing to monitor the situation closely and apply patches as they become available. FIT engineering will be reaching out as patches are released to setup emergency patching windows for FIT IT managed clients.

 

Recommendations:

If you are currently utilizing Log4j in your development or infrastructure, FIT recommends immediately applying the patch in version 2.17.0 (Java 8).

Additionally, these vulnerabilities have highlighted the importance of running a full application inventory of your environment and monitoring attack surface lists of affected applications to compare. It is critical to apply patches when available to all affected applications in your environment. The primary attack surface list in use by FIT Cybersecurity is published by Rumble and can be found here – Finding applications that use Log4J (rumble.run). It is updated daily, if not twice daily, and maintains the most complete list of applications affected by these vulnerabilities.

 

UPDATE — 12/17/21

CVE-2021-44228 & CVE-2021-45046

VMWare is starting to release patches for both vulnerabilities. Please reference this article against your environment to determine what patches are available for your infrastructure: VMSA-2021-0028.3 (vmware.com)

FIT Managed IT clients will be hearing from your engineering team as patches for your environment become available.

FIT Cloud Clients, emergency patches are being applied to your infrastructures this weekend.

Please Note: This is just the first round of patches and not everything has had a patch released yet. We anticipate this process continuing for the next few weeks at least. Depending on your environment, it is very possible you will need several emergency patching windows as more and more patches become available.

 

UPDATE —  12/16/21

We’d like to provide a status update of where we stand with the remediation efforts of the Log4j vulnerabilities (CVE-2021-44228 and CVE-2021-45046).

CVE-2021-44228

FIT Solutions’ Managed IT clients are 95% patched for on-premise assets that are affected by this vulnerability, and the last 5% are actively being worked on by the engineering team. This vulnerability scope is evolving as new applications and services are identified to be vulnerable. FIT Solutions is actively investigating and monitoring all client infrastructures to identify and address any newly discovered vulnerable systems.

CVE-2021-45046

This new vulnerability that was produced from the remediation of CVE-2021-44228 remains in the monitoring state. A few patches have been released to address this, but a majority of software and solution providers are still working on updated patches to address it. FIT Cybersecurity is actively monitoring the situation and engaging the engineering team as soon as patches become available to implement in client environments.

Updated Recommendation

FIT Cybersecurity is recommending an additional layer of protection that can assist in defending against the Log4j vulnerabilities. If it is possible in the environment, we recommend that Outbound LDAP communications be blocked on the firewall. This will not completely protect your environment from the Log4j vulnerability, but will hamper attempts by bad actors to exploit the vulnerability by utilizing LDAP. FIT Cybersecurity and FIT Solutions will continue to collaborate on monitoring the situation and remediating client environments. If you have any questions or concerns, please do not hesitate to reach out to info@fitsolutions.biz.

 

UPDATE — 12/15/21

A new vulnerability was discovered that impacts all assets affected by the initial Log4j Vulnerability (CVE-2021-44228). This new vulnerability (CVE-2021-45046) is less severe than CVE-2021-44228 coming in with a CVSS score of 3.7 out of 10. Do not let the lower CVSS score fool you, the vulnerability is still something that requires immediate attention.

The initial patch released for Log4j will prevent an attacker from gaining complete control over an affected asset, but that same patch can be abused by attackers resulting in a denial-of-service (DoS) attack on the affected asset. These DoS attacks have the ability to take an affected asset down by flooding the asset with requests at such a volume that the asset cannot handle the load.

Currently, software and solution providers are scrambling to release new patches of their software that address this new vulnerability. Apache, the initial source of both these vulnerabilities, has released a new version of the Log4j logging library that fixes this issue. If you actively use Log4j, please make sure you update your version to 2.16.0 which resolves both vulnerabilities.

Here are some additional resources for more information on the new vulnerability CVE-2021-45046:

Apache’s Fix for Log4Shell Can Lead to DoS Attacks | Threatpost

Second Log4j Vulnerability (CVE-2021-45046) Discovered — New Patch Released (thehackernews.com)

FIT Cybersecurity and FIT Solutions Response

FIT Cybersecurity and FIT Solutions are collaborating actively to patch all FIT Solutions IT clients and advise all cybersecurity clients on next steps. As more patches become available, FIT Solutions will reach out to IT clients for emergency patching windows. It is important to note, about 90% of affected assets from FIT Managed IT clients have been patched with the initial patch or a workaround has been implemented. The remaining 10% are actively being worked on to complete patching of the initial CVE-2021-44228.

 

UPDATE — 12/14/21

Only about 30% of the software vendors impacted have released patches thus far. We urge decision-makers to approve emergency patching all week if possible as updates come out during the week. Though patching updates can be disruptive to work, the interruption would be far less than that caused by a breach. Our cybersecurity team built custom monitoring alerts to increase threat hunting while we wait for patches to be released. Our team is also trained on emergency response actions to stop the exploit from being leveraged. We are working with all our clients to strategically make plans to minimize risk to their businesses. For users of FIT Cloud, we have applied the work-around fixes to VMware while a patch is being developed to protect the Cloud infrastructure.

 

INITIAL 12/13/21

Late last week, two vulnerabilities came to light that have made large waves in the cybersecurity space. We wanted to make sure you are informed of these new and potentially dangerous vulnerabilities. FIT Solutions stands ready to assist in any way we can as we go through the remediation of these new vulnerabilities. Please do not hesitate to reach out to support@fitsolutions.biz with any questions or concerns you may have.

 

Apache Log4j Logging Library Vulnerability | CVE-2021-44228 | CVSS 10.0

The Apache Log4j vulnerability was released late on Friday, December 10, and has a large attack surface with potentially dangerous effects. This vulnerability allows attackers to gain complete control of affected systems. The Log4j logging library is widely used and can be found in different services from Apple, Twitter, Steam, Tesla, Elastic Search, and more. Ranking as a CVSS 10.0 out of 10, this vulnerability poses a significant threat to those that utilize or interact with the Apache Log4j Logging Library, and it is already being exploited in the wild.

This is a high criticality vulnerability and deserves your immediate attention. Recommended remediation is to immediately upgrade any direct use of the Log4j library to log4j-2.15.0.rc2. Log4j is also utilized in several tools for logging, monitoring, alerting, and dashboard solutions. This means the issue may not be that you are directly using the library, but your tools are, which would also leave you vulnerable. In these instances, update your tools to the latest version and monitor their publishers’ releases to ensure you update to the release meant to fix CVE-2021-44228.

Log4j is also a dependency in large number of applications for business and personal use. In these circumstances, we must wait for the application provider to update the Log4j library. With the intense scrutiny and attention this vulnerability has received, we anticipate patching within the next couple days if the issue has not been patched already.

If you are not sure if you or one of the tools you utilize use Log4j, Huntress has come out with a utility to check if you are vulnerable – Huntress – Log4Shell Tester

Here are some additional resources for CVE-2021-44228:

Critical RCE Vulnerability: log4j – CVE-2021-44228 (huntress.com)

Security warning: New zero-day in the Log4j Java library is already being exploited | ZDNet

NVD – CVE-2021-44228 (nist.gov)

 

SMA-3217 – SMA100 Unauthenticated Stack-based Buffer Overflow| CVE-2021-20038 | CVSS 9.8

The Unauthenticated Stack-based Buffer Overflow vulnerability is significant but in much smaller scope than the Log4j vulnerability. Affecting SMA 100 series appliances, this vulnerability can allow an unauthenticated attacker to execute commands as the nobody user, giving complete control of the device to the attacker.

Currently, there are no reports of this vulnerability being exploited in the wild, but it still warrants patching if you utilize any of these appliances. A patch has already been deployed by SonicWall and is readily available to all organizations that utilize these appliances. Our remediation recommendation is to immediately apply this patch to all affected SMA appliances.

Here are some more resources for CVE-2021-20038:

Security Advisory (sonicwall.com)

NVD – CVE-2021-20038 (nist.gov)

Patch Now: Sonicwall Fixes Multiple Vulnerabilities in SMA 100 Devices | Rapid7 Blog

FIT Cybersecurity & FIT Solutions Response

FIT Cybersecurity already has monitoring deployed to watch for Log4j exploitation attempts and is closely monitoring all logs for evidence of these attempts on our clients. We are collaborating with the engineering teams for FIT Solutions customers to ensure any available patches are applied to your environment immediately.

We are ready to assist and answer any questions you may have concerning these vulnerabilities.

Should I Lease Multiple Domains for Cybersecurity?

Recently we hosted a webinar on Phishing & Whaling—How to Protect Yourself and Your Team. Melinda, one of our Solutions Executives, and Stormy, from our vCISO team, shared real-life examples and valuable insights to help educate business owners on the threats they face on a daily basis.

As Stormy explained examples of whaling attacks, one of our audience members posed an intriguing question: if cybercriminals are purchasing lookalike domains in order to phish you, would leasing multiple domains help prevent that?

Stormy’s answer? Both yes and no. Let’s get a little more context.

 

THE THREAT

One common scheme used in phishing attacks is domain spoofing, where a criminal leases a domain that is very similar to yours. For example, if your website is www.LawFirmABC.com, the attacker might lease www.LawFlrmABC.com, swapping the I for an L. Then he sets up an email address at that domain and sends an email to one of your team members posing as an employee. The swapped letter is easy to miss during a quick scan of an email that otherwise looks legitimate.

 

THE PROPOSED SOLUTION

Given that this scheme relies on the domains being fairly similar, the concept is that if you’re leasing multiple lookalike domains, you’ll keep them out of criminal hands and protect your organization against this type of attack.

In theory, yes, this could help. In fact, large companies like Google do this for this exact reason. When our own team uses domain spoofing during a social engineering campaign for a client, we turn any lookalike domains we leased over to the client’s control after the campaign ends. However, leasing multiple domains is not enough.

 

THE BETTER SOLUTION

In practice, this defense isn’t really practical; there are too many possible combinations to feasibly lease them all. Plus, it could lull your team into a false sense of security. The money you might spend leasing those domains would be better invested in cybersecurity awareness training for your employees. Staying alert and on guard at all times is vital to maintaining your organization’s security.

 

FIT Cybersecurity provides cybersecurity education and social engineering campaigns to organizations across all industries. If you’d like to test your company’s defenses or your team’s awareness of common cybercrime tactics, give us a call today at 888-683-6573 or contact us here.

PRESS RELEASE: SOCBOX Changes Its Name to FIT Cybersecurity in Major Rebrand

Network Security Provider Joins Sister Company FIT Solutions

San Diego, California, November 30, 2021 – SOCBOX has announced its name change to FIT Cybersecurity, joining its sister company FIT Solutions in a major rebrand. Founded in 2012 by CEO Ephraim Ebstein, the company is approaching its ten-year anniversary of helping organizations achieve their business goals through technology. FIT, which stands for Freedom Information Technologies, serves as an acronym uniting both brands under the same leadership and core values. Though the companies will remain separate entities along with their technical teams, Ebstein’s goal was to provide a more streamlined experience for clients and partners.

FIT Cybersecurity prides itself on providing quality solutions to critical industries such as legal, financial, education, healthcare and manufacturing. Ebstein shared the fundamental principles of the business: “FIT Solutions was created because of our desire to impact as many lives as possible for the better. This meant two things: creating opportunities for the team we care for dearly, and solving business problems for our clients to help those organizations achieve their objectives,” he said. “FIT Solutions looks to work with organizations that also have big goals so that together, we can help extend the reach to help as many people as possible.”

Unlike many of its competitors, FIT Cybersecurity offers an around-the-clock team of expert analysts, a human element that differentiates the company from others in the marketplace. “Most offerings on the market are proprietary tools that send alerts when incidents or suspicious activity are detected. Addressing such alerts still requires a human on your team to investigate and decide whether further action is necessary. Many organizations try to handle this in-house, but quickly realize that a single employee, even full-time, cannot properly monitor and manage the security tools because of 24/7 limitations,” Ebstein said. “We take care of that for you by acting as your 24/7 cybersecurity team, monitoring and managing whatever tools and systems you have in place for a fraction of the fully-burdened resources needed to handle it in-house. We investigate any activity or alerts, and take the appropriate action to deal with any security incident.”

FIT specializes in serving long-term healthcare facilities and law firms, both of which need solid IT and cybersecurity strategies. As Ebstein stated, “Technology and Cybersecurity are like the ‘tires and brakes’ of an organization. It is critical that they work well, especially the faster the organization moves. Those two services will determine whether an organization will be able to achieve its goals.”

However, the disparate branding had caused confusion for prospective partners, which Ebstein hopes to alleviate with the rebrand. “Our IT and cybersecurity offerings are very different and are operated by different technical teams. Despite that, our core values and the philosophy and processes used to deliver results are the same,” he said. When asked which businesses should consider FIT Solutions as their service provider of choice, he answered, “Businesses that are focused on growth, that are tired of having IT and cybersecurity issues and want the best value for their investment. Organizations that are focused on securing their assets and utilizing technology to allow them to scale successfully should have a conversation with us.”

Ebstein urges potential clients to research FIT Solutions to learn more. “The best way to see what it’s like to be a FIT partner is to look at our Google reviews. Two of our core values are ‘Raving Fan Culture’ (based on a book by Ken Blanchard) and ‘Results-Driven.’ This means it is in our DNA to overdeliver and, even when mistakes happen, to deliver results,” he said.

 

About FIT Cybersecurity: Formerly known as SOCBOX, FIT Cybersecurity is a subsidiary of FIT Solutions, offering a team of world-class cybersecurity experts dedicated to helping clients protect their valuable assets. In doing so, they combine a state-of-the-art Security Operations Center (SOC) with the best cybersecurity tools and managed security services available. FIT Cybersecurity becomes an organization’s cybersecurity team, monitoring the environment 24/7 to detect and prevent cyberthreats. Learn more here.

“I Passed My Compliance Audit; Now What?”

It’s that time again—time for your compliance audit. Depending on your business, it might be an annual audit from a government or regulatory entity, or it may be requested by someone with whom you’re about to do business—a prospective vendor, partner or client.

What’s involved in this audit? And if you pass, does that mean you’re good to go? What’s the next step?

What Is a Compliance Audit?

A compliance audit is a set of questions designed to make sure that you are complying with industry or federal regulations. Most often, these are related to security of information. The type of information varies, but the ultimate goal is the same: making sure that your organization is taking the appropriate steps to ensure the safety of the data that has been entrusted to you.

Audits across different industries ask different questions. A healthcare compliance audit will be looking for HIPAA metrics—steps taken to safeguard protected health information (PHI). Brokers are subject to FINRA compliance audits to ensure security in the financial industry, and organizations that contract with the government must comply with NIST requirements for cybersecurity.

Compliance audits average between 100-200 questions, most of which are highly technical and are best answered by your IT team or resource. It’s not a black-and-white pass/fail scenario, though. Since audits may vary not only by industry, but even from company to company, not every question will apply to your business. For example, a healthcare organization may send a HIPAA compliance audit to a potential vendor, but since the vendor doesn’t handle any PHI, many of the questions won’t apply. This doesn’t mean that the two can’t do business together; rather, it supports an informed discussion about their partnership.

If I Passed, That Means I’m Secure, Right?

Not exactly. As Anthony, one of our FIT engineers, explains, it’s just a first step. Compliance audits are concerned with different aspects of your business and environment, but not EVERY aspect. Some areas of your network are not included, but could still pose a vulnerability in your security.

Plus, most audit questions are not a simple pass/fail; you may have passed, but with the equivalent of a C. Think of your compliance audit as a report card—an assessment of where you’re at, and where you can improve. Once you identify those areas, what do you do about them?

Next Steps

Your compliance audit helps you develop a TBP, or Technology Business Plan, for what adjustments or improvements your IT environment needs over the next 3-24 months. Areas that barely passed or didn’t pass will be the primary areas of focus for your IT team, and can spur projects or other resolutions to help strengthen and streamline your network.

Since the main focus of compliance audits is security, take a good look at the cybersecurity measures you have in place. New threats emerge every day, so it takes a proactive approach and constant vigilance to counter attacks and defend against new vulnerabilities and exploits.

At FIT Solutions, we are your go-to IT resource. We complete compliance audits for you and make recommendations based on the results. We also help prepare your environment to meet and repel cyberattacks. Give us a call today at 888-339-5694 or contact info@fitsolutions.biz to see what elite IT service is like.

Why Firewall and Antivirus Aren’t Enough to Secure Your Business

“I have a firewall and antivirus, so I’m secure, right?” We hear this question from companies all the time. The answer is, that’s a great start, but you’re not quite done. Why not? To find out, let’s take a closer look at these two security measures.

What Does a Firewall Do?

A firewall is a program on your network that acts as gatekeeper, monitoring the inbound and outbound traffic. If you think of your business like a bank, the firewall would be like the security guard stationed at the entrance that prevents unwanted intruders from entering. That sounds like a pretty good system, until you consider a few drawbacks of firewalls.

  1. Firewalls operate based on predetermined rules. If someone figures out what those rules are, it’s not that hard to outsmart the firewall. In our bank example, your security guard may be instructed to turn away anyone in a red hat. Knowing this, the intruder wears a blue hat instead and is allowed to enter.
  2. A firewall is a reactive, problem-by-problem solution. It reacts to the immediate threat; it doesn’t look ahead to see the next approaching threat. The effectiveness of your firewall depends on those preset rules to block attacks, so if you’re not proactively watching the latest cyberthreats (and installing regular updates), it can’t fully do its job. This can leave you vulnerable to viruses or other cyberthreats.
  3. Your firewall protects your office network. If your employees access work emails or files from their personal devices, they can take that data outside of your company network. This has become a bigger threat with the recent pandemic-driven increases in work-from-home arrangements. Pandemic aside, though, if your employees conduct work outside of the office, perhaps using hotel Wi-Fi on a business trip, your company data could now be exposed on an unsecured network—where your firewall can’t protect it.
  4. Firewalls can’t stop user error. Criminals have a whole gamut of tricks for penetrating your system. Social engineering and phishing attacks in particular can completely sidestep your external defenses by targeting internal users. If one of your users unknowingly clicks a malicious link, your entire network could be shut down.

Does this mean you shouldn’t use a firewall? Absolutely you should; having a security guard with limited power is better than having none at all. We just want to make it clear why businesses shouldn’t entrust the safety of their data solely to their firewall.

What About Antivirus?

Antivirus is software that can prevent, detect, and remove malware. In our banking example, this would be like another security guard that makes regular rounds inside the bank, looking for suspicious activity. There are different kinds of antivirus software:

  1. Malware signature antivirus: This type scans for the digital fingerprint of a malicious program, known as a signature. The antivirus software comes preloaded with thousands of signatures, allowing the software to quickly identify and dispose of a threat that matches one from its database.
  2. System monitoring antivirus: This software identifies malware by looking for suspicious or unusual behavior—for example, if a user tries to access an unfamiliar website, or starts using significantly more data than usual.
  3. Machine-learning antivirus: Machine-learning pools data from multiple antivirus programs to recognize threats that it hasn’t seen before—an advantage over signature-based antivirus.

Given these abilities, why does antivirus not cover all the bases?

  1. Signature-based antivirus can only protect you against the threats that were programmed into it. It has no defenses against new threats or zero-day exploits.
  2. There are plenty of free antivirus software programs out there, and, while better than nothing, their database of malware signatures to check against is usually quite small. This drastically reduces the amount of threats it can protect you against.
  3. Antivirus doesn’t protect users against phishing attacks. A 2020 report by Check Point Research found that 65% of US organizations suffered a successful phishing attack in 2019—that’s two out of every three businesses!
  4. Most users don’t have antivirus on their phones or tablets, potentially leaving their device—and your network—vulnerable to attack.
  5. Cybercriminals represent the dark side of human ingenuity. They’re creative, constantly looking for new ways to get around your antivirus and firewall defenses. Even machine-learning antivirus software relies on combinations of data points. If an attacker figures out what combination will alert your antivirus to his presence, all he has to do is change one data point to trick it into marking him as legitimate traffic.

What You Can Do

  1. Update your firewall and antivirus regularly. Software patches and updates serve to reduce your system’s vulnerability and increase your software’s ability to identify and repel attacks.
  2. Develop a multi-layer security program. To return to the bank illustration, which bank would you trust with your money? A bank with one aged security guard? Or one with a whole patrol of security guards, cameras, alarm systems, biometric locks, and a dedicated monitoring team? Every security measure you add—SIEM, traffic analyzer, log management, SOC services, etc.—makes your organization that much stronger and more secure.
  3. Provide regular awareness training for your employees. Modern phishing and social engineering attacks are very sophisticated, and can be hard to identify. Just like your firewall and antivirus need to be updated frequently to stay effective, so does your team. A structured training program, either monthly or quarterly, can help your team recognize and repel attacks on your network.
  4. Don’t ‘set it and forget it’. Overconfidence or the feeling that you’ve already taken steps to defend your network can lull you into a false sense of security. Criminals are constantly testing new attacks, which calls for constant vigilance on our part to keep our defenses up to date. A third-party firm can conduct a social engineering campaign or penetration test for your organization to identify areas for improvement in your network or team.

FIT Solutions provides IT services, including cybersecurity packages. If you need an IT environment that scales with you, give us a call today at 888-339-5694 or contact us here.

Small Businesses: Does the CCPA Affect You?

The California Consumer Privacy Act (CCPA) went into effect January 1, 2020. This law deals with the right of consumers to know or even control how their personal information is used by organizations. For businesses that collect such information from consumers, this represents new burdens.

Do I Have to Comply with CCPA?

The CCPA comes with certain thresholds that may exclude some small or medium businesses from compliance requirements. What are these thresholds? You’re on the hook for compliance if you are:

  • Are a for-profit business operating in California
  • Collect personal information from consumers
  • Exceed one or more of the following:
    • Buy, receive, sell or share personal data from 50,000+ devices, consumers, or households
    • Have gross annual revenues of over $25 million
    • Sales of California residents’ personal data represents 50% or more of total annual revenue

I Don’t Meet the Thresholds, So Why Should I Worry About CCPA?

The CCPA is the most extensive privacy law ever passed in the US. Other states are taking a page from California’s book and are considering or have already passed similar legislation. Plus, the possibility of having different standards instituted across multiple states could result in the enactment of a privacy law at the federal level. So even if the CCPA does not currently affect you, it will eventually.

Looking at the legislative climate, given the CCPA and likelihood of more laws like it coming soon, it’s clear that there is an increasing recognition of the need for businesses to handle consumer data responsibly, for consumers to have the right to determine how that data can be used, and for businesses to protect consumer data against theft or loss.

What is “Reasonable Security”?

Part of the CCPA revolves around an organization’s responsibility to protect consumer data against theft or loss, like through a data breach. If a business fails to implement reasonable safety measures, resulting in a breach, they may be liable to pay penalties of $100-$750 per consumer per incident, or even higher. What would count as “easonable security” measures? The CCPA does not specify, but some legal experts refer to the state attorney general’s words in the California 2016 Data Breach Report:

“The 20 controls in the Center for Internet Security’s Critical Security Controls define a minimum level of information security that all organizations that collect or maintain personal information should meet. The failure to implement all the Controls that apply to an organization’s environment constitutes a lack of reasonable security.”

These CIS Controls are comprised of a set of 20 broad categories of action, each of which contains subcontrols in the form of specific tools and practices. These subcontrols vary based on the sensitivity of the data you’re protecting, the size of your organization, and the extent of your IT resources. Together, these controls form a defense strategy against breaches and cyberattacks.

We recommend that companies of all sizes take a look at the CIS Controls—especially if you’re at or near a threshold for CCPA compliance. At FIT Solutions, we use CIS Controls and other security frameworks, like NIST, to follow best cybersecurity practices for our clients. Contact us or call 888-339-5694 for help in strengthening your organization’s defenses.

Patch Tuesday & Hack Wednesday—Why Software Patching Is A Necessity

Applying software patches to fix security vulnerabilities is a key piece of system hygiene and protection against criminal computer attacks. Windows 10 is by default set up to handle this automatically. Unfortunately, for many users the prospect of having to stop the task at hand, wait for the updates to download and install, and hold off while the system restarts is too inconvenient. That leads many to delay the updates or tweak the settings so the updates can’t execute. This can be a big mistake—especially now.

The second Tuesday of every month is “Patch Tuesday”, when Microsoft rolls out the latest set of security patches to its operating systems and software. The set of patches first made available on April 14 closes many, many vulnerabilities. Every hour delayed in applying them leaves unpatched systems susceptible to attack.

A Whopper of a Patch Tuesday

This last Patch Tuesday was unusually large. It included:

  • 113 patches overall
  • 3 that close zero-day vulnerabilities/exploits for which no defense exists
  • 3 known to be actively used to infect systems “in the wild”
  • 17 deemed “critical”, which means a criminal can gain complete control over the system without any user interaction
  • 96 deemed “important”, which means that some user action is involved (with or without warning prompts)

The products impacted include the Microsoft Windows operating system itself, the Edge and Internet Explorer browsers, various Microsoft Office applications, Microsoft Office Services and Web Apps, Windows Defender, Microsoft Dynamics, Microsoft Apps for Android, and Microsoft Apps for Mac.

Why Prompt Patching is Vital

To help you quickly grasp the importance of patching, we’ll first define a few terms. The first two have specific meanings when applied to computer software security.

  • Vulnerability: A weakness or oversight in the way software is coded or structured. It allows the code to be overwritten or tampered with so that it performs some action other than what it was intended to do.
  • Exploit: Rogue software code that a criminal uses to take advantage of a vulnerability. Such an exploit could allow a criminal to gain unauthorized access to a system or gain administrator privileges. The aim is often to inject malicious software code into a running process, leading to the criminal gaining control of the system.
  • Zero-day:  A combination of a vulnerability and an exploit that either is unknown to the security community, or is so new that no defenses have been developed against it. A patch isn’t available to close the vulnerability. Security software hasn’t been updated or is unable to recognize the exploit and prevent it from being introduced into systems and executing.
  • In the wild: An exploit that’s out of the realm of being theoretical or a possibility. It’s being actively used to infect and take over systems.
  • Patch Tuesday: Microsoft’s monthly distribution of patches that close known vulnerabilities.
  • Hack Wednesday: What the security community calls the day after Patch Tuesday. When Microsoft releases the patches, criminal programmers are able to use the patches to understand the vulnerabilities. Within a day or two, the related exploits begin appearing for sale on the underground marketplaces of the “dark web”.

Put the above together, and you can see the importance of applying patches as soon as they’re available. The instant that the patches are released, criminals are racing to create the new exploits and infect as many machines as possible before the systems’ owners can get around to installing the patches.

How to Ensure Systems are Properly Patched

Assuming you’re running Windows 10, click on the Start button, then Settings, open Update & Security, then Windows Update. Here you can immediately check for updates, as well as review your settings to make sure you’re not effectively blocking the update process.

If you’re running a business with multiple machines, managing the update process to be sure that essential patches have been applied can be a time-consuming headache. As a managed service provider (MSP), here at FIT Solutions we use sophisticated tools to administer your systems and ensure your systems are up-to-date with the current patches—without inconveniencing your users. If you could use help with patch management, give us a call at 888-339-5694.

MSPs and Ransomware: Does Your Provider Practice What They Preach?

Managed service providers (MSPs) are coming under increased scrutiny because of a number of ransomware incidents reported on various security sites over the last 12 months. Criminals have learned that by infiltrating a single MSP, they can use the provider’s tools to infect and take hostage all of the MSP’s clients. Because the reporting of these incidents is haphazard, the number of compromised MSPs could be a handful, or it could be dozens. What is certain is that hundreds or thousands of their clients have experienced severe business disruption — or worse.

The enhanced scrutiny is justified, and as an MSP, we welcome it.  We use powerful tools to manage and monitor our clients’ networks and systems. With that comes a responsibility to ensure that our own security is equal to or greater than the level that we promote to our clients.

Healthcare MSPs in the Crosshairs

Given that many MSPs specialize in serving a certain type of business, here are a few examples drawn from healthcare organizations over last year:

  • During July, an MSP serving dental offices was infiltrated and used to spread ransomware across dozens of practices throughout Washington and Oregon. A week after the attack, the MSP realized it didn’t have the resources to restore all the impacted systems in a reasonable timeframe and advised customers to seek outside assistance with restoring their files. Two weeks after the attack, the MSP announced it was closing its doors.
  • An August attack on a Wisconsin-based MSP planted ransomware on 400 dental practices around the country. The attack encrypted not only patient files, but also emails and most worryingly, the company’s HIPAA-compliant backup system. A follow-up letter to their clients indicated that the MSP had a decryption key. Presumably, they paid the ransom.
  • In November, a Wisconsin-based MSP serving more than 100 clients, which operated nearly 2,500 nursing homes in 45 U.S. states, was hit, cutting off many of their facilities from patient records, email and telephone service. The MSP declined to pay the ransom. While it took days or weeks to restore the data, the MSP had a few factors working in their favor. One, a sharp-eyed employee spotted suspicious activity in the early morning hours during the attack and immediately alerted higher-ups within the company, who closed off the network. This limited the damage. Two, there were offsite backups.
  • In early December, a Colorado-based MSP was used to install ransomware on computers at more than 100 dental practices. The company refused to pay the ransom to unlock all of the client sites, and left the clients to restore their businesses on their own. Some negotiated separately to pay the ransom to restore their practices, while others restored from backups.

Closing the Vulnerabilities

Ultimately the criminals do their damage by gaining administrator access to the MSP’s remote monitoring and management (RMM) tool, which allows them to install and execute the ransomware infector on the clients’ systems. The following means of infiltrating and compromising administrator credentials are either explicitly known or have been implicated in one or more incidents. We also list the countermeasure; ask your MSP if these protections are in place.

Means of Gaining Administrator Access

Known vulnerability in an unpatched RMM tool or administrative console

Zero-day exploit in an RMM tool

Login credentials stored in cleartext on compromised machine

Exploiting open remote desktop protocol (RDP)

 

Phishing email

Protective Countermeasure

Program of regular, systematic and diligent patch management and application

Proactive monitoring of the MSP’s IT environment

Password vaulting solution or encryption and best-practices password policy

Disabling RDP if not needed, or application of access control lists to limit RDP sessions to known IP addresses

Email filtering solution backed with regular cybersecurity awareness training

Above All, Do This …

A single countermeasure would have stopped the vast majority of these attacks: Requiring two-factor (2FA) or multi-factor authentication (MFA) without fail, for each and every administrator connection and session, to each individual client’s IT environment. MSPs should enforce MFA to the enterprise login and ensure it encompasses VPN connections, RDP sessions, RMM sessions, internal management systems, and SaaS applications.

The other essential countermeasure is regular backups that are air-gapped or stored offsite. In far too many ransomware incidents, backups were stored online and the ransomware infector encrypted the backups as well, making them useless for restoring the client’s data. Also, in some instances the criminals first disabled the backup agents on each system, then waited for the old backups to age before executing the ransomware. So it’s important to not only have a backup system, but to monitor the backups and test for recoverability.

At FIT Solutions, we do all of the above and encourage you to ask your MSP if they do the same. We also have the advantage of our cybersecurity offering, SOCBOX, which provides us with the services of a Security Operations Center for 24-hour proactive monitoring—but we don’t stop there. We also contract with a separate third party to do regular penetration testing and evaluate our environment to ensure our defenses are solid.

If you’d like more information about MSP security, please give us a call at 888-339-5694.

Is Your MSP Proactive or Reactive? The Role of a Technology Business Plan

Here at FIT Solutions, we pride ourselves on the way our teams don’t just fix problems; they deliver additional business value for our clients. That means applying technology to improve operations, reduce costs, boost efficiency and productivity, and protect and enhance security. Let’s take a look at one of the primary ways we accomplish that: a regularly updated Technology Business Plan (or TBP, as we call it).

When you engage with us, we send one of our senior engineers onsite to take a holistic look at your facility and IT operations. A team of engineers assigned to you then delivers a set of recommendations. It is essentially a gap analysis between your current IT environment and prevailing best practices for an organization of your purpose, scope and size.

This is NOT a one-and-done exercise. The TBP is a living document, geared to a timeframe of up to 24 months, that is regularly updated to chart your progress. It’s a stepwise, realistic approach geared to budgetary realities and your own appetite for change and improvement. Many of the recommendations don’t cost anything.

While the recommendations are geared specifically to your organization, the TBP addresses four general areas.

Environment Enhancements

A great many IT environments have been built piecemeal over the years with a mix of workstations, Wi-Fi access points and various makes of networking hardware. We look for opportunities to consolidate and standardize, replace outdated equipment, and create common configurations that will make the entire environment easier to maintain and lower the cost of operations. We also address opportunities to cut costs and increase efficiency by switching Internet providers or swapping out telephone systems; bringing in management solutions for administering printers, computers, or mobile devices; making better use of existing software; or acquiring new solutions. Employees and staffing fall under this category as well, such as employee onboarding practices and user training.

Network Security

Many of the most valuable recommendations in this area are free, because they revolve around password-policy shortfalls such as password reuse, allowing short or weak passwords, not mandating regular changes, or instances where entire staff shares the same set of login credentials. Relatively low-cost security enhancements include cleaning out unused accounts and properly setting privileges. Additional security technologies such as multi-factor authentication, single sign-on, spam filtering and other email security measures, encryption or ransomware defense might be called for, depending on use patterns and your degree of susceptibility and exposure.

Licensing, Renewals, and Compliance

Here we address hardware and software that is reaching end-of-life or out-of-warranty, calling for replacement, refresh or upgrade as your budget allows. Legal matters such as email retention policies and your posture with respect to compliance and other regulations falls under this category as well, and might include our recommendations or referrals to third-party experts we have worked with.

Disaster Recovery and Business Continuity

This includes your backup and retention procedures and policies, and ability to restore if necessary. In addition, we consider shortfalls unique to your environment, such as whether you have remote users with critical files that need to be backed up, or whether you might be better served with a solution that enforces file storage on a network repository rather than individual workstations. We also consider your ability to work through a power outage or loss of Internet connectivity, and whether you need to have contingency solutions in place.

In this time of uncertainty and business upheaval, many are seeing a stark contrast between proactive and reactive managed service partners. Clients prefer proactivity. In our experience, clients appreciate these regularly updated technology business plans, especially if their experience with a previous IT service provider was more of a reactive, break-fix service than a proactive partner. Our clients use these reports to plan ahead, budget for essential improvements, and solve problems before they happen. Does this approach to IT services appeal to you? Give us a call at 888-339-5694.

Get in touch.

Fill out the form and our team will get
back to you as soon as we can!