Before understanding the countermeasures, let’s understand the sequence of events pertaining to the Cyber Attacks on All India Institute of Medical Sciences (AIIMS), a premier public medical research institution and a hospital based in New Delhi.

The cyber-attack on AIIMS was reported on 23rd November 2022, this lasted for more than 15 days & only by 6th December 2022,that the hospital was restored to normal, AIIMS confirmed that the trial runs of the e-Hospital server were successful, and most of the lost data had been retrieved. As a result of the incident, several patient care services, including registration, admission, billing, and discharge, appointment systems were inaccessible. Even the ‘e-Hospital,’ application system of the National Informatics Centre (NIC) was impacted by this incident & the hospital’s operations had to run manually to meet the immediate demands.

This ransomware attack could have corrupted huge data and medical records, including Personally Identifiable Information (PII) of patients and healthcare workers, and administrative records kept on blood donors, ambulances, vaccination, caregivers, employee login credentials, sensitive data, and medical records of VIPs. This kind of data is usually sold on the dark web by hackers.

The extent of the attack was so intense that multiple agencies like Delhi Police, the Centre’s Computer Emergency Response Team (CERT), the Ministry of Home Affairs, the Forensic Science Laboratory (FSL), and even the National Investigation Agency (NIA) sprang into action & the findings as reported by various media sources are as below

• IP addresses of two emails, which were identified from the headers of files that were encrypted by the hackers, originated from Hong Kong and China’s Henan province
• The hackers had two Protonmail addresses – “dog2398” and “mouse63209”.
• The targeted servers were infected with three ransomware: Wammacry, Mimikatz, and Trojan.

More could be revealed in times to come, but organizations must take the following steps to proactively prepare against cyber-attacks:

• Develop a comprehensive cybersecurity policy: A comprehensive cybersecurity policy should outline the organization’s approach to cybersecurity, including the roles and responsibilities of employees, the procedures for responding to security incidents, and the procedures for conducting security assessments. The policy should also include guidelines for protecting sensitive information, such as customer data and intellectual property, and for ensuring the security of the organization’s IT infrastructure.
• Conduct regular security assessments: Regular security assessments can help organizations identify potential security weaknesses and take steps to address them before they can be exploited by attackers. Assessments can be performed internally, or with the assistance of a third-party security consultant. Some common types of security assessments include penetration testing, vulnerability scanning, and security audits.
• Train employees: Employee awareness and training are crucial in the fight against cyber-attacks. Organizations should educate employees on the importance of cyber security, safe browsing habits, and how to identify and respond to phishing attempts. This can be achieved through regular training sessions, e-learning programs, and simulated phishing exercises.
• Implement multi-factor authentication: Multi-factor authentication (MFA) provides an additional layer of security beyond a simple password, making it more difficult for attackers to gain access to sensitive information. MFA can be implemented for all users, or just for those with access to sensitive information, such as administrators.
• Keep software up-to-date: Regular software updates can help fix security vulnerabilities, so it’s important to keep all software up-to-date to reduce the risk of successful cyber-attacks. This includes not only the operating system and applications, but also security software such as antivirus and firewall applications.
• Use encryption: Encrypting sensitive data can help prevent unauthorized access, even if the data is stolen or intercepted during transit. Organizations should use encryption for sensitive data in transit, such as when transmitting data over the internet, and for sensitive data at rest, such as data stored on servers and end-user devices.
• Backup data regularly: Regular backups can help organizations recover quickly from a cyber-attack or other data loss event. Backups should be stored off-site, or in the cloud, to ensure that they are not affected by a security incident at the primary location.
• Collaborate with other organizations: Sharing threat intelligence and best practices with other organizations can help improve overall security posture and respond more effectively to cyber-attacks. This can be achieved through information sharing initiatives, such as information sharing and analysis centres (ISACs), or through collaboration with industry groups and law enforcement agencies.
• Consider insurance coverage: Organizations may want to consider purchasing cyber insurance coverage to help mitigate the financial impact of a successful cyber-attack. Cyber insurance policies can provide coverage for costs such as incident response, legal fees, and compensation for customers whose data is compromised.

By taking these steps, organizations can proactively prepare against cyber-attacks and reduce the risk of a successful attack. Additionally, in addition to the general cyber security measures, organizations can also implement specific network and data security measures to protect their IT infrastructure and sensitive data. Some of these measures include:

1. Firewalls: Firewalls can help protect the organization’s network from unauthorized access by filtering incoming and outgoing traffic based on pre-defined rules. Organizations should consider implementing both perimeter firewalls and host-based firewalls to provide multiple layers of protection. Would highly recommend you to even consider Next-generation firewalls (NGFWs) in place of  traditional firewalls as they come with few some limitations in terms of their ability to detect and prevent modern cyber threats.
2. Virtual Private Networks (VPNs): VPNs can help secure communications between remote workers and the organization’s network by encrypting data in transit. This can help prevent unauthorized access to sensitive data, such as login credentials and confidential documents.
3. Access controls: Access controls can help ensure that only authorized users have access to sensitive data and systems. This can be achieved through the use of user authentication, such as passwords and biometrics, and through the use of role-based access controls, which restrict access to specific systems and data based on an individual’s role within the organization.
4. Data Loss Prevention (DLP): DLP solutions can help prevent the accidental or unauthorized release of sensitive information, such as credit card numbers and Social Security numbers. DLP solutions can be implemented through the use of software agents, or through the integration of DLP capabilities into existing security solutions, such as firewalls and email gateways.
5. Intrusion Detection and Prevention Systems (IDS/IPS): IDS/IPS solutions can help detect and prevent cyber-attacks by analysing network traffic and identifying suspicious activity. IDS/IPS solutions can be implemented as hardware devices, or as software applications running on servers or end-user devices.
6. Endpoint protection: Endpoint protection solutions, such as antivirus and anti-malware software, can help protect end-user devices from cyber-attacks by identifying and blocking malicious software and activities. Organizations should ensure that all end-user devices, including laptops, smartphones, and tablets, are protected by up-to-date endpoint protection software.
7. Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) solutions: Unlike a end point security solutions, EDR & XDR solutions can help organizations detect and respond to cyber threats more effectively, and can complement other security measures, such as firewalls, intrusion detection systems, and anti-malware software.

By implementing these network and data security measures, organizations can further strengthen their defence against cyber-attacks and protect sensitive data. It’s important to regularly review and update these measures to ensure that they remain effective in the face of changing cyber security threats.

HOME | ABOUT US

Vulnerability Assessment and Penetration Testing: A Proactive Approach to Cybersecurity

Vulnerability Assessment and Penetration Testing (VAPT) is a process of identifying, evaluating, and prioritizing the vulnerabilities in a computer system, network, or web application. Vulnerability assessment is performed to discover and analyze potential security weaknesses in a system, while penetration testing involves simulating an attack on the system to evaluate the security measures in place and assess the overall resilience against real-world threats.

The purpose of VAPT is to identify potential risks and security weaknesses, prioritize them based on their level of criticality, and provide recommendations for remediation. It helps organizations to ensure that their systems and applications are secure and protected against potential threats & the process in general typically involves the following steps:

• Planning: In this stage, the scope, objectives, and limitations of the VAPT are defined, and the assessment plan is developed.
• Reconnaissance: In this stage, information is gathered about the target system, such as IP addresses, domain names, and open ports, to identify potential vulnerabilities.
• Scanning: In this stage, automated tools are used to scan the target system and identify potential vulnerabilities.
• Analysis: In this stage, the results of the scans are analyzed to determine the level of risk and impact of each vulnerability.
• Exploitation: In this stage, the tester attempts to exploit the vulnerabilities to determine the actual risk posed by the system.
• Reporting: In this stage, the results of the VAPT are documented, and a report is prepared that includes a detailed analysis of the vulnerabilities and recommendations for remediation.
• Remediation: In this stage, the recommendations from the report are implemented to mitigate the identified vulnerabilities and improve the security of the system.
• Verification: In this stage, the tester verifies that the remediation efforts have been successful in mitigating the vulnerabilities.

A few tools (Open Source and commercial) are used in the above process, typically in combination, as shown below, and new tools are being developed and updated. regularly to meet the evolving needs of the cybersecurity community.

• Nessus: A popular vulnerability scanner used to identify vulnerabilities in a variety of systems, including web applications, databases, and operating systems.
• OpenVAS: An open-source vulnerability scanner that provides comprehensive scanning and reporting capabilities.
• OWASP ZAP: A popular open-source web application security scanner that supports both manual and automated testing.
• Metasploit: A comprehensive platform for security testing and exploitation, used to simulate real-world attacks and evaluate the security of systems.
• Nmap: A popular open-source tool used for network exploration, security scanning, and vulnerability assessment.
• Acunetix: A web application security scanner that provides in-depth analysis of web applications, including those built with modern frameworks.
• Burp Suite: A popular integrated platform for web application security testing, used for vulnerability assessment, penetration testing, and reporting.
• sqlmap: An open-source tool used for automating SQL injection attacks and testing the security of databases.
• Wireshark: A network protocol analyzer that provides detailed information about network traffic, including potential vulnerabilities and security issues.

And if you are wondering about the frequency of these VAPT audits it actually depends on several factors, including the size and complexity of the system, the risk profile of the organization, and the evolving threat landscape. In general, regular VAPT helps organizations in staying ahead of evolving cyber threats leading to a strong security posture for the organization.

While these VAPT audits are valuable tools for identifying security risks, they are not perfect and can have certain flaws. Some of the most common flaws with VAPT audits include:

• Limited scope: VAPT audits may only test a limited subset of the systems and applications within an organization, which can result in missing important vulnerabilities.
• False negatives: VAPT audits may miss some vulnerabilities, especially those that are difficult to detect or are hidden within the system.
• False positives: VAPT audits may produce false positive results, which can lead to wasted time and resources trying to remediate non-existent vulnerabilities.
• Static testing: VAPT audits may only test the systems at a particular point in time, which can result in missing new vulnerabilities that have been introduced since the last audit.
• Stale information: VAPT audits may rely on outdated information or knowledge of vulnerabilities that have been addressed or mitigated, leading to an incorrect assessment of the security posture.
• Limited resources: VAPT audits may be limited by the availability of resources, including time, budget, and expertise, which can result in a less comprehensive assessment.
• Dependence on tools: VAPT audits may be overly dependent on automated tools, which can lead to a lack of understanding of the underlying vulnerabilities and the most effective ways to remediate them.

Despite these flaws, VAPT audits remain a valuable tool for identifying and mitigating security risks and are an important component of an overall security program. And if you are convinced that VAPT is no silver bullet for your overall security program, there are several alternatives to Vulnerability Assessment and Penetration Testing (VAPT) that organizations can consider as part of their overall security program:

• Threat modelling: This approach involves analyzing the system architecture and identifying potential threats, as well as the most effective ways to mitigate those threats.
• Continuous security monitoring: This approach involves using tools and techniques to continuously monitor the systems and applications for signs of vulnerabilities and threats.
• Red teaming: This approach involves simulating a realistic attack scenario in order to test the organization’s security posture and response capabilities.
• Code review: This approach involves conducting a thorough review of the source code of an application in order to identify potential vulnerabilities.
• Configuration management: This approach involves establishing and maintaining secure configurations for all systems, applications, and networks, in order to reduce the risk of vulnerabilities.
• Security automation: This approach involves using automation tools and techniques to improve the efficiency and effectiveness of security processes, such as vulnerability scanning and remediation.

These alternatives can complement VAPT and provide a more comprehensive understanding of the organization’s security posture. The most appropriate option (or) alternative to choose will depend on the organization’s specific requirements, size, and complexity of its systems and applications.

HOME | ABOUT US

Why Network Monitoring is essential for Business Operations

A Network Management System (NMS):- is a software application or set of tools used to manage and monitor the performance, availability, and overall health of a computer network. These tools work by collecting, processing, and analyzing network data in real time. The general steps involved in the process are as follows:

• Data collection: The first step is to gather data from network devices, such as switches, routers, and servers. This is typically accomplished using various protocols, such as Simple Network Management Protocol (SNMP), Common Information Model (CIM), and Remote Monitoring (RMON).

• Data processing: The collected data is processed by the NMS tool, which filters and categorizes the data according to various parameters, such as network performance, availability, and security.
• Data analysis: The processed data is analyzed by the NMS tool to identify trends, patterns, and anomalies. This can be used to detect and resolve network issues, as well as to provide real-time network visibility.
• Alert generation: If any issues or anomalies are detected, the NMS tool will generate alerts and notifications, which can be sent via email, SMS, or other methods. These alerts can be used to notify IT staff of potential problems, and to provide information that can be used to resolve the issue.
• Reporting and analysis: The NMS tool will also provide detailed reports and analysis of network performance, availability, and security. These reports can be used to identify trends, patterns, and performance issues, as well as to monitor network compliance with regulations and standards.
• Monitoring and management: Finally, the NMS tool will provide ongoing monitoring and management of the network, including the ability to perform routine tasks, such as software updates, backups, and device configuration changes.

There are many commercial and open-source versions of Network Management Systems (NMS) tools, each with its own set of features and functions and available for on-premises or cloud deployment. Ultimately, the best NMS tool for a particular organization will depend on the specific needs and requirements of that organization.  NMS can play a critical role in helping organizations to counter cyber security threats as well as ensure compliance with regulations and standards.

Some ways in which NMS can help include:

• Monitoring network traffic: NMS tools can be used to monitor network traffic and identify unusual or suspicious activity, such as attempts to access sensitive data or unauthorized access to network resources.
• Identifying vulnerabilities: NMS tools can be used to scan network devices and servers for vulnerabilities, such as outdated software or misconfigured settings. This can help organizations to identify and address potential security risks before they can be exploited.
• Detecting and responding to security incidents: NMS tools can be used to detect and respond to security incidents, such as malware infections or denial-of-service attacks. By collecting and analyzing security-related events and alerts, NMS tools can help organizations to quickly identify and respond to potential threats.
• Compliance: Many NMS tools can provide detailed reports and audit trails, which can be used to demonstrate compliance with various regulations and standards, such as HIPAA or PCI-DSS.
• Isolation: Some NMS tools can be used to automatically isolate compromised devices or networks segments, in order to contain and prevent the spread of malware or other malicious code.

What happens when your NMS tool itself gets hackedhe consequences can be severe and far-reaching, depending on the extent and impact of the hack. Some possible outcomes include:

• Loss of network visibility: If the NMS tool is compromised, the attacker may be able to modify or delete data, or interfere with the normal functioning of the tool. This can result in a loss of network visibility and control, making it more difficult to detect and respond to network issues.
• Data theft: Attackers may be able to access sensitive data stored on the NMS tool, such as network configuration details, passwords, and other confidential information.
• Tampering with network devices: If the attacker has gained access to the NMS tool, they may be able to modify or delete configurations, or install malware on network devices. This can result in network downtime, performance degradation, or security breaches.
• Spreading of malware: If the attacker has installed malware on the NMS tool, they may be able to use it as a stepping stone to compromise other devices on the network.
• Loss of trust: If the NMS tool is hacked, it can result in a loss of trust in the organization’s ability to secure its network and protect sensitive data. This can have serious reputational and financial consequences, especially for organizations that are subject to regulations and standards, such as HIPAA or PCI-DSS.

In order to prevent these outcomes, it is important to implement appropriate security measures, such as next generation firewalls, access controls, encryption, and regular software updates, to help protect the NMS tool and the network.

Additionally, it is recommended to regularly back up and store network data in a secure location, to ensure that it can be recovered in the event of a security breach.