This is a story of network segmentation and the impact that seemingly trivial misconfigurations can have for your organization. This is one of those occasions.
This particular pen test asked for goals-based assessment focusing on post-compromise activities — an attempt by the client to discover how vulnerable internal systems were to lateral movement by an attacker who had compromised the domain. Among the goals was a request to attempt to compromise the client’s Amazon Web Services (AWS) infrastructure and a secondary request to access and exploit any systems discovered to contain sensitive or critical operational data .
Read more…
Source: Rapid7
Related:
- US rejecting dialogue on cyber sphere with Russia undermines information security
May 4, 2024
The US administration rejecting dialogue with Moscow on the cyber sphere undermines international information security, Russian Ambassador to Washington Anatoly Antonov said on the embassy’s Telegram channel. “We regard such statements as another example of megaphone diplomacy and evidence of Washington’s irrepressible desire to accuse Russia of all mortal sins. We have repeatedly told the US: ...
- Russia launches production of smartphones with protection against data leaks
May 3, 2024
Companies of the state corporation Rostec and the Rostelecom operator have launched a production line for the assembly of Russian smartphones AYYA T1 with protection against data leakage, the Aurora mobile operating system reported. The Aurora mobile operating system is developed by Rostelecom. The gadget is available for corporate customers in two versions – with Android ...
- New laws to protect consumers from cyber criminals come into force in the UK
April 29, 2024
Consumer protections against hacking and cyber-attacks will come into force today, as all internet connected smart devices will be required by law to meet minimum-security standards. Manufacturers will be legally required to protect consumers from hackers and cyber criminals from accessing devices with internet or network connectivity – from smartphones to games consoles and connected fridges ...
- Universities Boost Spending to Curb Cyber Attacks
April 25, 2024
Higher education institutions have increased their cybersecurity budgets as more universities fall prey to cyber attacks, Moody’s Investor Service says in a report. The bond ratings agency reports that higher education institutions allocating a portion of their budget to cybersecurity increased more than 70 percent from 2019 to 2023. Despite the new spending jump, universities still ...
- Are We Ready for a Cyber Attack on Food and Farming?
April 23, 2024
Federal officials and lawmakers are preparing to defend against cyber attacks that would leave residents without reliable access to food by targeting the food and agriculture sectors. The latest preparation effort is Cyber Storm — a massive, multiday tabletop exercise involving state, local, tribal, territorial, federal and private-sector organizations — and it probed how well participants ...
- UK government cannot protect businesses and services from cyber attacks
April 22, 2024
UK businesses are rapidly losing confidence in the government’s ability to protect them from cyberattacks. This is according to a new report from cybersecurity researchers Armis, which states that the lack of faith is higher than anywhere else in Europe. To draft the report, Armis surveyed more than 2,600 global security and IT decision-makers, and included ...