CISA Warns of Vulnerabilities in Cloud Use, Shares Solutions List

The Cybersecurity and Infrastructure Security Agency shared 21 bullet points—more for organizations using Microsoft’s Office 365—for diminishing the extent to which adversaries are taking advantage of challenging-to-secure cloud configurations. 

Analysis CISA issued Wednesday draws from incidents the agency has responded to where indicators of compromise show threat actors effectively targeting organizations’ use of the cloud with techniques such as phishing. 

While CISA has been responding to federal agencies and private-sector organizations dealing with the fallout from the hacking campaign associated with the compromise of software from IT management firm SolarWinds, the agency noted that the analysis is not explicitly related to that specific threat actor.  

CISA “is aware of several recent successful cyberattacks against various organizations’ cloud services,” the analysis reads. “Threat actors are using phishing and other vectors to exploit poor cyber hygiene practices within a victims’ cloud services configuration.”

The term “cyber hygiene” is meant to capture the lowest-common-denominator things organizations can do to protect their systems from unauthorized access. But remote working conditions necessitated by the pandemic are raising that bar for organizations and highlighting the complexity involved in securely navigating cloud environments. 

“These types of attacks frequently occurred when victim organizations’ employees worked remotely and used a mixture of corporate laptops and personal devices to access their respective cloud services,” CISA said. “Despite the use of security tools, affected organizations typically had weak cyber hygiene practices that allowed threat actors to conduct successful attacks.”

Among the list of solutions are measures to protect against phishing. Organizations should “focus on awareness and training,” and ensure employees know how threats can be delivered through such scams, for example. CISA also advised organizations to “establish blame-free employee reporting and ensure that employees know who to contact when they see suspicious activity or when they believe they have been a victim of a cyberattack,” in the interest of more quickly implementing mitigation strategies.

But after initial access is established by obtaining a phishing victim’s legitimate credentials, attackers can run rampant undetected, using their access to read emails as well as to identify additional legitimate credentials and reroute messages to their own offsite accounts. Victims had been using the ability—allowed by Outlook Web App— to have their work emails forwarded to their personal accounts. The attackers also manipulated these forwarding rules to send potential phishing warnings to folders storing RSS feeds, reducing the likelihood they would be seen.

The solution set against these techniques include routinely reviewing user-created email forwarding rules and alerts, auditing email rules with enforceable alerts, or restricting forwarding and enforcing multifactor authentication. 

But attackers are also bypassing multifactor authentication by stepping in imprints left by legitimately credentialed activity. “In this case, CISA believes the threat actors may have used browser cookies to defeat MFA with a ‘pass-the-cookie’ attack,” the agency said. 

Among CISA’s solutions is to “have a mitigation plan or procedures in place; understand when, how, and why to reset passwords and to revoke session tokens.” The MITRE encyclopedia of tactics, techniques and procedures known as ATT&CK lists “configure browsers or tasks to regularly delete persistent cookies” as a mitigation measure.

Users of Microsoft’s Office 365 should consider specific mitigations, CISA said. The suite of cloud-based services was specifically named in the Justice Department’s disclosure of its compromise by the SolarWinds attackers, and CISA and the National Security Agency have tailored their guidances to address Microsoft’s cloud environment. 

“Assign a few (one to three) trusted users as electronic discovery (or eDiscovery) managers to conduct forensic content searches across the entire M365 environment (Mailboxes, Teams, SharePoint, and OneDrive) for evidence of malicious activity,” CISA said, among other O365-specific recommendations.

Providers of cloud-based security services weighed in on the increasingly difficult challenge of securing such environments.

“IT staff can be a scarcity—let alone a cybersecurity team,” Jim Richberg, Fortinet Public Sector Field CISO, told Nextgov. 

“Systems are getting more and more complex, which limits the number of folks to verify the fidelity of those systems,” added Michael Cardaci, CEO of FedHIVE. 

Ben Johnson, former NSA hacker and co-founder and chief technology officer of the firm Obsidian Security, noted: “With the popularity of cloud and how easy it is to become interconnected and scaled, these attacks are not going away.”

RELATED PODCAST