Following the recent high profile cyber-attack on Stryker Medical by the Iran-based Cyber Group Handala, I think it’s fitting to discuss threat prevention methods even for a Global Admin (GA) Account which appears to have been compromised in this case.
Yes, the GA account can circumvent some or part of these measures, but security isn’t a ‘one size fits all’ solution. Security is an accumulation of measures, a layered defense that makes it extremely difficult for an attacker to circumvent collectively. As it’s still early days and we don’t have the full details, let’s discuss Microsoft’s 365 Identity & Access Security features that would have stopped or slowed down the attacker.
👉🏻Multi-Factor Authentication (MFA)
Not all MFA methods are secure, a man-in-the-middle (MitM) attack can obtain authentication methods like push notifications with Microsoft Authenticator or SMS authentication. Phishing resistant methods like FIDO2 keys or passkeys using Windows Hello should be the default authentication method used by organisations. Microsoft have mandated the use of MFA for privileged accounts, so it’s likely some form of MitM attack occurred here.
👉🏻Multi-Admin Approval (MAA) ✔️
A secondary admin is required to approve potentially destructive actions on a Microsoft 365 Tenant. Organisations can configure an ‘access policy’ which cover different policy types such a device actions (delete, retire, wipe), roles (create, edit, assign, delete) and more. Circumvention can be difficult here when the ‘Roles’ access policy type is implemented. In the Stryker incident, Graph API calls to wipe devices would need to be approved for each device action type. This would have certainly triggered an alert!
👉🏻Privileged Identity Management (PIM) 🪪
PIM is your just-in-time (JIT) access feature configured in Microsoft Intune for privileged roles. Here you can assign roles that require activation when needed and expire after a set amount of time. You can set the activation to require a business justification and an approver to verify, like MAA. It’s evident that Stryker didn’t use PIM or make use of the approver function.
👉🏻Conditional Access – Named Locations 🌎
A mistake I see consistently is the configuration of named locations, named locations are used to ‘tag’ an identity’s location using two methods, IP addresses and GPS coordinates. Yes, an IP Address can be spoofed quite easily but determining a location by GPS coordinates is more difficult to circumvent because the Microsoft Authenticator app requests the location services from the device the end user is signing in with.
Organizations use named locations to provide access based on a trusted country, but rarely a policy blocking certain countries which follows the zero-trust methodology. In this case, Stryker could have created a ‘Blocked Countries’ list, selected all, de-selected the counties their IT Teams operate in and created a CA policy to block access to all admin portals.
👉🏻Risk-Based Conditional Access ⚠️
Risky users and sign-ins are detected using Microsoft’s Machine learning and Threat Intelligence engine, the engine is fed information from many data points to identify threat actors and patterns, called signals. Microsoft uses these signals to designate a risk score to an identity (Low, Medium, High). With the correct licensing for Identity Protection, organisations can utilise Microsoft’s risk scores to block access to a tenant using a sign-in risk or user risk policy. These policies are basic; there’s more flexibility using Risk-based Conditional Access policies. I’ll delve into these in a future blog.
👉🏻Identity Governance – Access Reviews 📋
Access Reviews don’t have to be manual, as part of the Microsoft Entra Identify Governance suite, ‘Access reviews’ can be conducted automatically and targeted at groups and applications periodically. Say for instance, there’s a ‘SysAdmin’ security group containing accounts with the Global Admin role. You can configure Access Reviews so that the ‘Reviewer’ must act on an accounts access to the ‘SysAdmin’ group otherwise block actions can be automated if the reviewer ignores the report. This prompts a reviewer to conduct an access review, drill into the account and justify its access. Microsoft Entra Access reviews are not a silver bullet; however, they can be used to find the breadcrumbs necessary to identify a malicious actor/entity.
👉🏻Final Thoughts 💭
There is a cost to use the above features, but with good practices organisations don’t need to break the bank if they follow the principle of least privilege and regularly reviewed accounts. If a GA is required, then the authentication methods should be cycled and sign-in logs monitored daily. Stryker failed to do the basics, and it cost them greatly.
To learn more, visit: What is Microsoft Entra ID Protection? – Microsoft Entra ID Protection | Microsoft Learn
