TYPE OF ORGANIZATION

An accounting office from the SME sector, managing critical financial and personal data of its clients on a daily basis. The company did not have a dedicated IT team, which meant that responsibility for security was blurred in everyday operational duties. The work environment was based on a network of workstations where sensitive documentation was processed.

SOURCES OF VULNERABILITY TO ATTACKS

ESET software was installed on the computers, but there was no central management system and no protection against unauthorized uninstallation.
The infrastructure was based on a simple router without network segmentation, which allowed for free traffic flow between all devices.
The biggest risk was that all users worked on accounts with administrator privileges, and each workstation had a technical account with the same credentials.

INCIDENT

One mistake was enough: an employee opened a malicious email. Because the user had administrator privileges, the malware was able to uninstall the antivirus software without hindrance and begin the process of encrypting data.

Thanks to shared administrator credentials on all computers, the attack quickly spread to other workstations, paralyzing the entire office.

WHY WAS THE ATTACK SUCCESSFUL?

No AV protection: the antivirus software did not have tamper protection, which allowed hackers to easily disable it.
Ignoring the principle of least privilege: working on administrator accounts opened the door for attackers to penetrate deep into the system.
Lack of segmentation and monitoring: simple network architecture and lack of constant log monitoring allowed attackers to move freely between computers without being detected.

EFFECTS OF THE INCIDENT

Office work was completely halted, and access to key financial data was lost for the duration of the system recovery.
Restoring functionality required manual intervention on multiple workstations simultaneously.
There was a real threat of a breach of customer data confidentiality, which in the financial industry entails enormous responsibility and damage to reputation.

THE ROLE OF SOC ADQ: WHAT WOULD CHANGE?

Detection of protection uninstallation: our analysts would immediately receive an alert about the antivirus software being disabled on the first workstation.
Response to abuse of privileges: SOC monitoring systems would detect unusual administrator logins and attempts to spread the attack across the network.
Limiting the scale: thanks to rapid intervention, the infected device would be isolated before the ransomware had time to encrypt data on other computers.

KEY CONCLUSIONS:

Without central management and protection against uninstallation, AV software becomes an easy target for hackers.
Sharing administrator accounts is unacceptable. Restricting permissions is the basis of protection.
Constant monitoring reduces incident detection time from days to minutes, which drastically reduces losses and allows the business owner to sleep peacefully.

Use cases

Use cases: how SOC works and when you need it

USE CASE #1

From an outdated smartphone
to mass spam from a company domain

LEARN MORE

USE CASE #2

How ransomware paralyzed a warehouse
with an outdated ERP system

LEARN MORE

USE CASE #4

One laptop, 200 points of sale,
and total paralysis – how ransomware
brought a nationwide retail chain to a standstill

LEARN MORE

USE CASE #5

Lack of monitoring leading to theft of funds from a company account

LEARN MORE

USE CASE #3
LACK OF CONTROL OVER AUTHORIZATIONS LEADING
TO PARALYSIS OF THE ACCOUNTING OFFICE

TYPE OF ORGANIZATION

SOURCES OF VULNERABILITY TO ATTACKS

INCIDENT

WHY WAS THE ATTACK SUCCESSFUL?

EFFECTS OF THE INCIDENT

THE ROLE OF SOC ADQ: WHAT WOULD CHANGE?

KEY CONCLUSIONS:

Check your network for leaks free of charge