Thomas Neudenberger 💻🔐✋✔️

Remember the Colonial Pipeline attack in 2021? Hackers gained access to one password for a VPN account (ATO - Account Take Over!) and infiltrated the system leading to a shutdown. After asking for $4.4 Million they were paid within hours and provided a tool to restore the system. It still took 5 days to resume operations and the president declared an emergency. Once data is downloaded (Snowden Breach) there is nothing that can be done. The clear advice is to do EVERYTHING possible to prevent breaches from the beginning! 60% of small businesses that suffer a cyberattack go out of business within six months. Large companies face financial losses, reputational damage, legal troubles, regulatory fines, and a profound erosion of consumer trust.

Security can never be 100%. It is like a big wall that we can make higher and wider but with enough motivation, time, and funding bad guys will find a way to conquer the wall. The security teams need to deploy realtime detection and better PREVENTION capabilities. To identify an unauthorized task you first need to uniquely identify the actual user in the system. Next, you need to re-identify that user when a sensitive task is executed. Similar to security cameras in a convenience store pointing at a cash register to prevent employees from stealing money you need to put similar technologies in place in your IT system. Biometrics on the function level is the only way to truly detect and even prevent costly and embarrassing breaches.

I would respectfully disagree. Creating stronger and more complex passwords only forces the user to write them down and keep them nearby. We have seen customer and government installations that proudly increased their passwords from 8 to 12 and even 15 characters. It resulted in an increased demand for yellow sticky notes to write them all down and keep them in the right upper drawer :-). During the Cold War, a sophisticated launch code system was developed to protect unauthorized access to launch US nukes known as Permissive Action Links (PALs). While that system was very secure all launch codes were reset to 8 Zeros for 20 years! This was done so anybody could launch them in case of an emergency. The solution is 2FA or MFA!

While it is important to monitor the system for potential irregularities it is equally important to monitor the employees. Employees are successful with fraud when they can cover it up. They can't cover it up when they are on vacation. Look at those that never go on vacation! Also check who might be living larger than they should (nice cars, houses, boats, watches). Many are caught because they can help to show off their newfound wealth. A lot of fraud was discovered during COVID because procedures and people changed. SO change things up! Or better - put technology in place to reduce the risk of fraud - like granular biometric controls with dual confirmations (requesting 2 biometrically identified users together).

For the past 22 years, I have protected global SAP customers from unauthorized access to sensitive functions. ATO's or Account Take Overs are the common denominator for the biggest fraud cases. Edward Snowden persuaded 20 government employees to share their passwords resulting in the largest data breach in NSA history. Jérôme Kerviel stole coworkers' passwords for months resulting in $7.2 BILLION in damages at Societe General. Hackers don't hack in - they log in using somebody else's password! AI brings phishing attacks to a new level and access passwords (including SAP) can easily be purchased on the dark web. Prevent ATO's (Account Take Overs) and you prevent breaches!