How to Prevent Crimes Like This OneWhile there is no perfect method to prevent these attacks from occurring in the future, simple steps can be taken by any institution that has public computers without becoming a “big brother,” including:
- Remove all administrator rights. Users logging into public systems should be standard users or guests. If applications need admin rights, a least privilege solution can elevate the application and mitigate the risk of the actual user being an admin.
- Do not store the local profile of the user once they log in. If the system is compromised, the local disk could still have the remnants of a previous user’s files.
- Re-image the public computer frequently. Some solutions perform this after each use but this method will keep the system pristine and in compliance with the original specifications.
- Assess for risks frequently. These systems by definition are public and can have vulnerabilities like any other asset. They should be assessed for vulnerabilities and patched frequently to ensure that modern attack vectors due not circumvent other security controls.
- Harden the asset. Using CIS, SANS, or the US DoD STIGS harden the host to eliminate unnecessary services, applications, configuration weaknesses that could be exploited.
- Ensure physical security. Disable, remove, or cover all exposed USB ports to prevent the introduction of dongles that can be used for exploitation. These are tools that do not require software access like software keystroke loggers but can perform the same as hackers using a physical device inserted inline.
- Software inventory the systems for compliance and disable the installation of any new software, drivers, etc. except from approved sources like a software delivery tool or patch management.
Morey J. Haber, Chief Security Officer, BeyondTrust
Morey J. Haber is the Chief Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored three books: Privileged Attack Vectors, Asset Attack Vectors, and Identity Attack Vectors. He is a founding member of the industry group Transparency in Cyber, and in 2020 was elected to the Identity Defined Security Alliance (IDSA) Executive Advisory Board. Morey currently oversees BeyondTrust security and governance for corporate and cloud based solutions and regularly consults for global periodicals and media. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition where he served as a Product Owner and Solutions Engineer since 2004. Prior to eEye, he was Beta Development Manager for Computer Associates, Inc. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.