96: The Police Station Incident

Key takeaways

Proper network segmentation and controlling remote access are vital to security, preventing attackers from easily infiltrating critical systems.
Administrative privileges should be strictly limited and not shared among multiple users to reduce the attack surface and improve accountability.
Regular testing and validation of backups are essential to ensure data recovery during incidents; backing up alone isn't enough.
Phishing remains a primary attack vector; awareness training and email security are crucial to prevent breaches.
Organizations must prioritize security design and best practices over convenience—exposing critical systems to the internet with shared admin credentials is a significant risk.
In cybersecurity, quick response and forensic analysis can neutralize threats before damages escalate, underscoring the importance of incident readiness and expertise.

Summary

The Mysterious Cause of the Router Crash

The episode begins with a story about a router in an office that unexpectedly crashed and rebooted on its own. The manufacturer attributed the cause to 'spurious emissions from space,' explaining that cosmic rays can pass through the Earth's atmosphere and circuits, causing bit flips that may malfunction the device. The narrator initially finds this explanation incredulous, contemplating how many unexplained computer issues might stem from cosmic phenomena.

Nicole Beckwith’s Background and Role in Cybersecurity

Nicole Beckwith, a former police officer and federal marshal, shares her journey into cybersecurity. Her extensive training with the Secret Service in digital forensics, combined with her work investigating cybercrimes, highlights her expertise. She discusses her responsibilities, including responding to cyber incidents, analyzing digital evidence, and the importance of continuous learning in the cybersecurity field.

Responding to a Police Department Ransomware Attack

Nicole recounts her investigation into a police department struck by ransomware, which had crippled their systems. She describes the process of responding to the attack, including mobilizing with a 'go bag' of tools, securing access to the network, and collecting evidence while the attack was ongoing. She emphasizes the challenges of conducting forensic analysis under active attack conditions and the importance of quick action.

Technical Forensic Examination and Initial Findings

Using tools like volatility and Wireshark, Nicole’s team analyzed memory and network traffic to identify malicious activity. They discovered an unauthorized admin account login during her visit, indicating someone gained remote access. The investigation revealed suspicious activity targeting sensitive police data, and she intervened by revoking access and securing the systems, illustrating the importance of proactive digital forensics.

Security Failures and Network Configuration Issues

Nicole highlights critical security flaws, such as the police department’s domain controller being accessible from the internet with shared administrative credentials. She stresses the dangers of such designs, which expose the network to external threats. Her efforts to disconnect external access and redesign the network architecture underscore the need for proper security protocols.

The Local Hacker and Human Factors in Cybersecurity

Further analysis linked a local IP address in the police attack to the suspect. A detailed investigation traced the hacker to the mayor’s computer, who was compromised via a phishing email. The use of shared admin accounts among city officials exemplifies poor security practices. The story underscores how human error and lax security policies create vulnerabilities.

Post-Incident Changes and Lessons Learned

Following the breach, the police department undertook significant changes: replacing security vendors, wiping and upgrading systems, locking down remote access, and improving password management. The incident also led to broader organizational awareness and reforms, including restricting admin privileges and securing critical systems. The episode concludes with reflections on lessons learned about network security and governance.

Show notes

Nicole Beckwith wears a lot of hats. She’s a programmer, incident responder, but also a cop and a task force officer with the Secret Service. In this episode she tells a story which involves all of these roles.

https://twitter.com/NicoleBeckwith