How to Prevent Crimes Like This OneWhile there is no perfect method to prevent these attacks from occurring in the future, simple steps can be taken by any institution that has public computers without becoming a “big brother,” including:
- Remove all administrator rights. Users logging into public systems should be standard users or guests. If applications need admin rights, a least privilege solution can elevate the application and mitigate the risk of the actual user being an admin.
- Do not store the local profile of the user once they log in. If the system is compromised, the local disk could still have the remnants of a previous user’s files.
- Re-image the public computer frequently. Some solutions perform this after each use but this method will keep the system pristine and in compliance with the original specifications.
- Assess for risks frequently. These systems by definition are public and can have vulnerabilities like any other asset. They should be assessed for vulnerabilities and patched frequently to ensure that modern attack vectors due not circumvent other security controls.
- Harden the asset. Using CIS, SANS, or the US DoD STIGS harden the host to eliminate unnecessary services, applications, configuration weaknesses that could be exploited.
- Ensure physical security. Disable, remove, or cover all exposed USB ports to prevent the introduction of dongles that can be used for exploitation. These are tools that do not require software access like software keystroke loggers but can perform the same as hackers using a physical device inserted inline.
- Software inventory the systems for compliance and disable the installation of any new software, drivers, etc. except from approved sources like a software delivery tool or patch management.