LEARN MORE...

Home
Documents
October 2021
6
Cyb206 national university week3 discussion

Cyb206 national university week3 discussion

Content type

User Generated

Uploaded By

orettl

Pages

Showing Page:

1/2

On May 7th, 2021, one of the largest refined fuel pipelines in the United States, the Colonial

Pipeline, experienced a ransomware attack which temporarily disrupted the flow of fuel

deliveries between the Gulf Coast and the eastern seaboard of the United States. As a result, the

pipeline was shut down for approximately one week, a ransom of 4.4 million in crypto currency

was paid, a state of emergency was declared, and worldwide publicity highlighted the

vulnerability of the US power grid.

Although the full details the investigation have yet to be released, various media sources site

Darkside ransomware as the perpetrators of the attack. This statement has been also confirmed

by the FBI. What is not well known, is that Darkside is a group that develops malicious code and

sells it to various unknown cybercriminals. This is known as Ransomware-as-a-Service (RaaS),

and Darkside claims no affiliation with the hackers that targeted the colonial pipeline. Be that as

it may, the FBI has since recovered approximately half the crypto currency paid for the ransom

demand.

There is much speculation regarding the specificity is of the attack. However, from a strategic

viewpoint, Darkside ransomware typically begins with an unauthorized access to a device. This

can be achieved through a variety of methods that include phishing emails with malicious links,

or a brute force password attack. from there, the attackers will attempt to elevate their privileges

and gain access to sensitive data. This feat can be accomplished by utilizing a Netlogon Remote

Protocol, a credential harvesting application, or a Local Security Authority Subsystem Service

(LSASS) process memory dump that contains memory files with usernames for passwords for a

domain. There is also speculation that hey information operations technology (IoT) was

exploited to gain access to the IT infrastructure. Either way, these types of ransomware attacks

conclude their process by encrypting the sensitive data they have recovered and locking an

organization out of their own proprietary information. at a tactical level, the malicious code

begins the encryption process by using a copy of the ransomware store and a share folder on the

initial device. From there, the attacker can create a scheduled task for spreading virus throughout

the organization's network. This appears to be consistent with the colonial pipeline ransomware

attack.

Allegedly, colonial pipeline was able to recover 600 gigabytes of stolen data. However, the risk

of leaked information likely attributed to the decision of paying the ransom demand. In any case,

this attack highlights the necessity of mitigation tools which can combat against similar type

cyber-attacks in the future period. A good place to start, in my opinion, is by prioritizing

information security. This begins with adopting security policies which invest in highly trained

cybersecurity professionals and promote education of cyberthreats for all users and employees.

Next, security policy needs to outline acceptable usage of devices and only allow authorized

devices to have access to the network. In addition, further mitigation could include multi factor

authentication, regular security audits, and regularly scheduled backups.

References:

FBI Statement on Compromise of Colonial Pipeline Networks. (2021, May 10). Federal Bureau

of Investigation. https://www.fbi.gov/news/pressrel/press-releases/fbi-statement-on-

compromise-of-colonial-pipeline-networks

Showing Page:

2/2

Unformatted Attachment Preview

On May 7th, 2021, one of the largest refined fuel pipelines in the United States, the Colonial Pipeline, experienced a ransomware attack which temporarily disrupted the flow of fuel deliveries between the Gulf Coast and the eastern seaboard of the United States. As a result, the pipeline was shut down for approximately one week, a ransom of 4.4 million in crypto currency was paid, a state of emergency was declared, and worldwide publicity highlighted the vulnerability of the US power grid. Although the full details the investigation have yet to be released, various media sources site Darkside ...
Purchase document to see full attachment