Detecting and Dealing with Compromised Accounts in Cloud Platforms

Transcription

1 Detecting and Dealing with Compromised Accounts in Cloud Platforms Nick Young - IT Manager, Application Administration Kevin McClain - Google Apps Administrator UNC CAUSE :45-2:30pm, Thursday October 6th

2 UNCG: Population Context ~30,000 enabled accounts ~23,000 actively used accounts 19,000 Student Accounts 4000 Employee Accounts

3 UNCG - How we got here - Incremental Improvements Pre No automated detection of compromised accounts Standardized pieces of the process Google Admin + IT Security + Service Desk What actions are taken for a compromised account AUTOMATION = Better, faster, stronger Trashing known phishing from UNCG Recipient Mailboxes (preventing more compromises) More source data

4 Start with the basics: Source Data Pre No automated detection of compromised accounts Only Google alerts for suspicious or suspendable activity Built Google Support Tool, aka GST (in-house PHP) Google Login Logs & Suspicious Activity Alerts via API Enterprise Authentication (Shibboleth) Logs via Splunk API Spring Duo Security (2FA) via Splunk API Late MyCloud (Citrix) logs via Splunk API

5 RULES & EXCEPTIONS

6 Compromise Rules - Types Successful Login IP Address Geolocation (Splunk / MaxMind) Event Type

7 Compromise Rules - IP Example : Known origin of phishing/compromises

8 Compromise Rules - Geolocation Examples Continent: Africa Country: Nigeria Geo-location: Manassas, Virginia, United States of America, North America

9 Compromise Rules - Multiple Country Logins Configurable time window 2 Countries within 2 hours Greensboro, NC at 9:00am; Lagos, Nigeria at 9:05am == Automatic Process as Compromise Greensboro, NC at 9:00am; Lagos, Nigeria at 11:01am == No Automatic Process

10 Compromise Exceptions Individual Username-based Exempts from automated processing Does not exempt from manual processing Time limited (start & end date) Automated notifications to user before end date Requires discussion with SD or Google Admin Traveling, Regular VPN use, Study Abroad etc NOT to allow foreign parents to access account

11 PHISHING (just briefly)

12 Phishing Detection & Cleanup 1. Mostly manual detection / reporting to Google Admins 2. Content Compliance Rules implemented in Google to prevent future/similar attacks 3. Log -> GST -> API = Move Phish to User s Trash 4. Notify Recipients that they were targeted, recommend 2FA 5. Process users as compromised if they report clicking/using on Phishing Link

13 ACTIONS

14

15

16 Compromised Account Actions - Google 1. Local Google Password Reset (IMAP, POP, Old Apps etc) 2. 3rd Party OAUTH Tokens removed 3. Forwarding Rules checked/removed 4. Account Suspended (prevents any activity) 5. Duo 2FA Enrollment Status checked via API 6. Remedy Ticket Created via API

17 Compromised Account Actions - Manual/Service Desk 1. Require reset of UNCG enterprise password Prevents login via Shibboleth / LDAP etc 2. Unsuspend Google Account after UNCG password reset 3. Contact User by Phone Explain incident Explain remediation steps (re-setup OAuth apps etc) Recommend 2FA Enrollment

18 METRICS Are we getting better at: Prevention? Detection? Making our users less-good targets?

19 Metrics: Total Phishing Attacks Processed 173 Since March 23rd 2015

20 Metrics: Average Phishing Attacks One Attack Every... 5 days 2 days 25 days March 1st 2015 To Dec 31st 2015 Jan 1st 2016 To July 31st 2016 Aug 1st 2016 To Oct 5th 2016

21 Metrics: Total Compromises Processed 3204 Since August 2014

22 Metrics: Average Total Compromises Per Day March 1st 2015 To Feb 29th 2016 March 1st 2016 To July 31st 2016 August 1st 2016 To Oct 5th 2016

23 Metrics: Average Employee Compromises Per Day March 1st 2015 To Feb 29th 2016 March 1st 2016 To July 31st 2016 August 1st 2016 To Oct 5th 2016

24 Metrics: Average Student Compromises Per Day March 1st 2015 To Feb 29th 2016 March 1st 2016 To July 31st 2016 August 1st 2016 To Oct 5th 2016

25 Other Stuff / What s Next Mandatory IT Security Training in Canvas, reports back to Banner for dept oversight (March 2016) Citrix, LDAP, more? added to source data set CloudLock API - add/replace parts of logic

26 Other Stuff / What s Next DMARC prevention of -spoofing - go.uncg.edu/dmarc Multiple Compromises == 2FA requirement Include data Classification + Access to sensitive data

27 Q & A

28 UNC Mel Radcliff UNCG Kevin McClain Nick Young Sched.org