The Achilles Systems Hack Assessment Series: Getting Strategic with Vulnerability Management - Part 3 of 4 for Operational Leadership
Part 3 of 4
In this webcast, we will quickly review the incident affecting Achilles Systems, including their basic “block and tackle” approach to vulnerability management. Then we will dive deep into a better approach that might have reduced or eliminated the impacts of the breach they suffered. We will dive into topics such as:
- The need for a more comprehensive vulnerability management approach
- The role of strategic priorities and intelligence in vulnerability management
- How an improved vulnerability management capability will better position Achilles to resist future attacks
Background Information
Achilles Systems, a fictitious IT service provider to human resources teams in medium and large businesses, has fallen victim to an attack in which sensitive customer data and, potentially, customer networks, have been compromised. Achilles has a small security team who has historically focused on basic controls and compliance. However, it seems clear this attack was the work of a sophisticated adversary capable of circumventing the controls in place.
Much of Achilles’ security has not been maintained since an initial push many years ago, and newer controls were bypassed or disabled by the attacker. Some examples of these are multi-factor authentication, which the attacker bypassed in part by impersonating a Achilles executive in a call to the Service Desk. Later in the intrusion, the attacker disabled Achilles’ endpoint detection and response agents while moving through the internal network. Once the attacker achieved access, they quickly moved to systems containing sensitive data and parts of the network where direct customer access was possible.
As Achilles works to recover from the attack and regain customer trust, it seeks to invest in a more advanced defense able to withstand a more capable and determined attacker. Achilles management is committed to revisiting its security controls, devising better ways to proactively identify and remediate vulnerabilities, and investing in ongoing efforts to identify and respond to attacks before the damage is done.
This webcast supports concepts from LDR516: Building and Leading Vulnerability Management Programs.
Register for all parts in the series:
Part 1: Breach or Blueprint? Building a Threat-Informed Defense
