{"id":57730,"date":"2024-11-22T14:18:18","date_gmt":"2024-11-22T14:18:18","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/36631\/Heres-What-Happens-If-You-Dont-Layer-Network-Security-Or-Remove-Unused-Web-Shells.html"},"modified":"2024-11-22T14:18:18","modified_gmt":"2024-11-22T14:18:18","slug":"heres-what-happens-if-you-dont-layer-network-security-or-remove-unused-web-shells","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/heres-what-happens-if-you-dont-layer-network-security-or-remove-unused-web-shells\/","title":{"rendered":"Here’s What Happens If You Don’t Layer Network Security Or Remove Unused Web Shells"},"content":{"rendered":"

The US Cybersecurity and Infrastructure Agency often breaks into critical organizations’ networks \u2013 with their permission, of course \u2013 to simulate real-world cyber attacks and thereby help improve their security. In one of those recent exercises conducted at a critical infrastructure provider, the Agency exploited a web shell left behind from an earlier bug bounty program, scooped up a bunch of credentials and security keys, moved through the network and ultimately pwned the org’s domain and several sensitive business system targets.<\/p>\n

In a Thursday blog post, the Agency (CISA) detailed the exercise and opined<\/a> they “illuminate lessons learned for network defenders and software manufacturers about how to respond to and reduce risk.” In other words: give it a read and learn from this critical infrastructure organization’s mistakes \u2013 and the things it did well \u2013 to keep real criminals out of your IT environment.<\/p>\n

The CISA red team conducted the operation over a three-month period, we’re told. It went in blind, with no prior knowledge about the organization’s technology assets.<\/p>\n