The Backup Break-In
Hackers accessed ConnectWise's cloud backup app identities and broke into Microsoft 365 tenants, where multi-factor authentication was ineffective.
Key terms
AP Cybersecurity alignment
- 4.2.C.6Multifactor authentication (MFA) is when a system uses more than one factor to authenticate a user. MFA is more secure than single-factor authentication because it requires the user to provide at least two separate factors of…Learning objective: Determine the type of authentication used to verify the identity of a user.
- 4.4.A.3Authentication logs (or auth logs) record every attempted login on a system. Analysis of authentication logs can reveal attempted attacks.Learning objective: Explain how to detect attacks against devices.
- 5.2.C.7The principle of least privilege is the idea that entities should be given exactly as much access as they need to perform their function and no more.Learning objective: Determine an appropriate access control model to protect applications and data.
AP Networking alignment
- 4.1.A.3When confidentiality is compromised, systems are vulnerable to having sensitive data exposed or stolen. A breach of confidentiality can be identified by: • unauthorized access • network traffic showing exfiltration of…Learning objective: Identify evidence of compromised confidentiality, integrity, or availability.
- 4.5.B.4Security controls to limit the impact of unauthorized access include: • enforcing strong password policies and account lockout settings • applying the principle of least privilege • implementing segmentation to restrict access…Learning objective: Determine appropriate security controls to limit the impacts of common threats and vulnerabilities in a managed network.