How to Prevent Crimes Like This OneWhile there is no perfect method to prevent these attacks from occurring in the future, simple steps can be taken by any institution that has public computers without becoming a “big brother,” including:
- Remove all administrator rights. Users logging into public systems should be standard users or guests. If applications need admin rights, a least privilege solution can elevate the application and mitigate the risk of the actual user being an admin.
- Do not store the local profile of the user once they log in. If the system is compromised, the local disk could still have the remnants of a previous user’s files.
- Re-image the public computer frequently. Some solutions perform this after each use but this method will keep the system pristine and in compliance with the original specifications.
- Assess for risks frequently. These systems by definition are public and can have vulnerabilities like any other asset. They should be assessed for vulnerabilities and patched frequently to ensure that modern attack vectors due not circumvent other security controls.
- Harden the asset. Using CIS, SANS, or the US DoD STIGS harden the host to eliminate unnecessary services, applications, configuration weaknesses that could be exploited.
- Ensure physical security. Disable, remove, or cover all exposed USB ports to prevent the introduction of dongles that can be used for exploitation. These are tools that do not require software access like software keystroke loggers but can perform the same as hackers using a physical device inserted inline.
- Software inventory the systems for compliance and disable the installation of any new software, drivers, etc. except from approved sources like a software delivery tool or patch management.
Morey J. Haber, Chief Technology Officer and Chief Information Security Officer at BeyondTrust
Morey J. Haber is Chief Technology Officer and Chief Information Security Officer at BeyondTrust. He has more than 25 years of IT industry experience and has authored four Apress books: Privileged Attack Vectors (2 Editions), Asset Attack Vectors, and Identity Attack Vectors. In 2018, Bomgar acquired BeyondTrust and retained the BeyondTrust name. He originally joined BeyondTrust in 2012 as a part of the eEye Digital Security acquisition. Morey currently oversees BeyondTrust strategy for privileged access management and remote access solutions. In 2004, he joined eEye as Director of Security Engineering and was responsible for strategic business discussions and vulnerability management architectures in Fortune 500 clients. Prior to eEye, he was Development Manager for Computer Associates, Inc. (CA), responsible for new product beta cycles and named customer accounts. He began his career as Reliability and Maintainability Engineer for a government contractor building flight and training simulators. He earned a Bachelor of Science degree in Electrical Engineering from the State University of New York at Stony Brook.