The Cyber Defense eMagazine November Edition for 2023

from basic hygiene concerns like patch maintenance and breach detection to higher order concerns such
as managing security policy and direction, all reside entirely with security staff, executives, and system
administrators retained by the organization. The ability to prevent attackers from successfully breaching
systems, moving laterally, and ultimately gaining access to these "God" accounts is entirely a function of
how much the organization prioritizes security, and in some cases, how much legacy baggage to which
they are subjected.
As Attack Surface Expands, Targets Shift
Contrast this with modernized organizations: What does the attack surface look like when many businesscritical
assets have now been shifted to the cloud, organizations are increasingly leveraging third parties
to handle what were previously core business IT functions (i.e., the adoption of products like Office365
and G Suite), many employees are working remotely, and more development processes have migrated
from slow, gated releases to being effectively continuous? Fundamentally, it means that the traditional
system administrator accounts likely don't have credentials centralized in quite the same way they were
before, and traditional access vectors outside of more unsophisticated approaches like phishing, such as
exploitation, are more expensive than they were previously. It becomes much more challenging, for
example, to find an unpatched mail server or domain controller to compromise when that entire function
has now been effectively outsourced to Microsoft.
Additionally, engineering teams now have far more access than they enjoyed previously, with far fewer
security controls. Many organizations have no endpoint protection on developer systems or have policy
exceptions for build and test directories. Cloud infrastructure is often maintained "as code.” Many modern,
business-critical assets are now described by a set of scripts that are read, modified, tested, and deployed
through Continuous Integration / Continuous Deployment (CI/CD) solutions.
The same is generally true of most modern development processes. Large enterprises now field
hundreds or thousands of builds every day. From a security perspective, software developers and CI/CD
systems now have access to a tremendous amount of business-critical functionality. In order to operate,
developers often have administrative access to cloud infrastructure, credentials for production data, and
intellectual property, not to mention systems featuring little-to-no security tooling, almost universal local
administrative privileges, and unfettered access to download things from the open internet.
What this means is the balance has shifted. In the past, system administrators were the quick, easy
targets attackers used to gain broad access and the ability to operate with impunity throughout an
organization. Those targets have become harder and much more expensive for attackers to reach, with
now substantially-reduced rewards.
On the other hand, modern organizations face an absolutely staggering amount of risk in the activities
performed by their development workforces and processes, including CI/CD infrastructures, and
shockingly few tools exist to help mitigate or even give insight into the challenges faced.
On top of this, attackers have taken note - leveraging these open channels to steal credentials, production
data, intellectual property, and more. Perhaps the most frightening aspect of most of these incidents is
Cyber Defense eMagazine – November 2023 Edition 104
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.