_Simon_Dannhauer_Alamy.jpg?disable=upscale&width=1200&height=630&fit=crop)
July 9, 2024 at 10:03AM
The cyberattack on Ivanti’s asset management software has prompted action from CISA and raises questions about exploit techniques, breach response, and downtime costs. Attackers bypassed authentication and gained unauthorized access, prompting CISA to intervene and take Ivanti’s systems offline. The incident emphasizes the importance of robust cybersecurity measures and proactive response strategies to protect critical assets and mitigate risks.
The key takeaways from the meeting notes are:
1. The Ivanti software attack highlights the importance of robust cybersecurity measures and proactive infrastructure design to mitigate risks and protect critical assets.
2. The vulnerabilities in Ivanti’s system allowed threat actors to exploit the VPN gateway, bypass authentication, and gain unauthorized access. The attackers could export user credentials, including domain administrator credentials, and inject malicious code into the Ivanti appliance, enabling persistent access to the VPN.
3. CISA’s intervention and decision to take two of Ivanti’s systems offline were based on the assessment of the risk and the potential blast radius of the breach. The agency’s approach was to safeguard the system’s crown jewels, the most powerful credentials, by minimizing the potential for further compromise.
4. The calculated decision for a complete system shutdown was driven by the need to minimize the blast radius of the attack, given the severity of the vulnerabilities and the potential for widespread exploitation. It emphasizes the importance of minimizing high value targets in IT infrastructure and accelerating the adoption of strategies and technologies that eliminate such targets.
5. The miscommunication between Ivanti and CISA regarding the deployment of patches highlights the necessity of clear, open channels of communication during a crisis to avoid unnecessary chaos.
6. Measuring hard and soft costs associated with entire system level downtime is crucial, considering the IT resources, service outages, user downtime, downstream effects, reputational impact, and service level agreement considerations.
Overall, the incident underscores the significance of collaboration, clear communication, and continuous vigilance to safeguard against future threats, and emphasizes the need for organizations to prioritize cybersecurity and proactive response strategies to minimize risks and protect critical assets.