3. Protecting backups against logical destruction 

As part of a defense‑in‑depth approach to backup protection, and in light of the threat landscape observed, the assumption of an illegitimate takeover of components within the storage and backup infrastructure must be considered. 

More generally, in order to effectively reduce the risk of data loss, best practice dictates ensuring that backups are not exposed to the same risks (cyber or otherwise) as the stored data. This approach is notably based on diversifying backup media, implementing physical or logical segregation, and maintaining at least one isolated copy that is both offline and off‑site. 

The use of mechanisms designed to prevent the alteration or deletion of backed‑up data,even in the event of a successful attack on the storage and backup infrastructure, should therefore be considered. 

Immutability and air gapping represent the two main approaches in this area. While these concepts are widely promoted by vendors, the solutions available and the residual risks associated with their implementation vary. It is therefore essential to fully understand the underlying mechanisms of these solutions in order to select the one that best addresses the required risk coverage. 

According to the Cyber Benchmark conducted by Wavestone, nearly 65% of organizations implement immutability or air‑gapping mechanisms, at least for critical functions, and 21% apply them across all of their backups. 

Backup Immutability, an Increasingly Adopted Technique 

“Data immutability means that data can be written but cannot be modified or deleted” (NIST). 

Far from being uniform, its implementation relies on a variety of technical approaches whose robustness varies depending on whether they are based on hardware or software mechanisms. 

a. Purely Hardware-Based Mechanisms 

• LTO WORM cartridges (with compatible hardware/firmware) 
  These magnetic tape cartridges allow data to be written once, preventing any subsequent modification or deletion, provided that the hardware and firmware support WORM (Write Once, Read Many) mode. 

     For more specific use cases : 

• Blu‑ray jukeboxes 
  This robotic system uses WORM Blu‑ray discs to permanently store data, rendering it physically unalterable once written. 
• Flash storage with WORM controller (firmware / e‑Fuse bit) 
  Some flash storage devices incorporate a controller with dedicated firmware or hardware mechanisms such as e‑Fuse bits, enabling data to be permanently locked after being written. 

b. Software-Based Mechanisms, Embedded or Appliance-Based 

• Hardware appliance with local management 
  This is a backup‑dedicated appliance, locally configured to enforce immutability policies, often through software locks or non‑modifiable retention periods. 
• Hardware appliance with online management 
  This type of appliance enables remote management, sometimes via an out‑of‑band channel, ensuring that immutability policies cannot be altered even if the primary network is compromised. 
• Software installed on the organization’s operating systems 
  Some software solutions allow immutability rules to be defined directly at the operating system level. However, this approach may be less robust, as it can be vulnerable if the host system is compromised. 
• Cloud capabilities (e.g., Amazon S3 Glacier / Azure Blob Storage) 
  Cloud storage services offer immutability features through retention policies or WORM locks, ensuring that stored objects cannot be modified or deleted for a defined period. 

It should be noted that the level of immutability can be adjusted based on the nature of the data concerned, in order to optimize the balance between security requirements and operational constraints. 

Immutability is increasingly observed as a mechanism deployed within backup protection strategies and remains more commonly implemented than air gapping. 

Backup Air Gapping : A Technique Observed but Less Optimized 

An air gap4 is defined as “an interface between two systems in which (a) the systems are not physically connected and (b) any logical connection is not automated (i.e., data is transferred across the interface only manually, under human control).” 

Like immutability, air gapping can be implemented in various ways, including: 

Physical implementations  :

1. Offline, protected tape storage (primarily at a remote site) 
   Magnetic tapes are removed from the active backup system and stored in a physically separate location, preventing any network or automated access. 
2. Tapes stored in a backup robot 
   Although physically connected, certain backup robot configurations allow tapes to be logically disconnected when not in use, thereby limiting the risk of unauthorized access. 
3. Other removable storage media such as disks (stored offline) 
   Hard drives or SSDs can be used to transfer data, then physically disconnected and stored in a secure environment, ensuring full isolation. 
4. Optical data diode transfer gateways 
   These devices enable one‑way data transfer, physically preventing any return flow of information or commands to the source system and providing a certain level of separation. When native support is not provided by backup software vendors, third‑party software agents enabling unidirectional transfer must be used in addition. 

Logical Air‑Gap Implementations (Departing from Physical Isolation) :

1. “Saloon door” network ports opened only during synchronization 
   Network connections are temporarily enabled to allow data synchronization and then automatically disabled, thereby limiting the exposure window and requiring strict controls to ensure that only legitimate replication traffic is authorized. 
2. Isolation through access control and encryption capabilities 
   Strict access control mechanisms combined with encryption make it possible to restrict access to backups to precisely defined users and time windows. 
3. Backup as a Service (isolated private cloud / third‑party cloud) 
   Some externalized backup offerings provide full logical isolation by segregating customer environments and limiting network interactions to strictly controlled channels. However, the risk of compromise is not null, as illustrated by a successful attack in 2025 against an online backup service targeting firewall configurations. 

Subject to a risk analysis, particularly when relying on logical solutions, implementing data immutability should generally be prioritized over air gapping. 

While immutability and air gapping constitute effective safeguards to preserve the integrity, and even the confidentiality, of traditional backups against risks of modification or exfiltration, other approaches that are more focused on operational optimization also warrant consideration. 

In this context, the objective is no longer to secure full data copies, but rather to rely on alternative mechanisms enabling rapid and large‑scale restoration, often at the cost of certain trade‑offs. This is notably the case with snapshots, which have emerged as a preferred technical solution in environments where recovery performance takes precedence over backup completeness or robustness. 

Snapshots: A Fast Recovery Solution, but Not a Full-Fledged Backup 

To better understand what the concept of a snapshot technically entails, it is useful to refer to the definition provided by NIST: “A record of the state of a running image, typically captured as the differences between a reference image and the current state.” 

In other words, a snapshot represents an instantaneous capture of the state of a file system or data volume at a given point in time. Unlike a full backup, it records only the blocks or files that have changed since the reference state. This mechanism, which is fast and resource‑efficient, is particularly well suited to environments where rapid recovery is a priority. It is therefore widely used in virtualized and cloud infrastructures. 

However, this operational efficiency comes with notable trade‑offs in terms of backup quality. Snapshots do not constitute independent copies of data; they depend on the integrity of the host system. In the event of corruption of the primary volume, snapshots may become unusable. In addition, their lifecycle management (rotation, retention, application consistency) requires particular rigor to avoid operational drift. 

While effective in accelerating business recovery, snapshots cannot replace a true backup strategy. They should be considered as a complement to more robust mechanisms that ensure long‑term data durability and integrity. 

Whether dealing with snapshots or traditional backups, their integration into a protection architecture requires a thorough risk analysis, including the identification of residual vulnerabilities. 

4. Risk-Based approach and identification of residual risks 

Given the stakes associated with irreversible data loss and/or prolonged disruption of critical business activities, risk analysis applied to backup mechanisms is not an optional step but rather a fundamental pillar of a consistent and well‑controlled backup strategy. 

Embedding Risk Analysis at the Core of Backup Management 

Whether or not it is part of a formal certification or authorization process, conducting a risk analysis of backup mechanisms aims to ensure that the controls in place are aligned with identified threats and business continuity requirements. 

In this context, a risk analysis applied to backups, based, for example, on the EBIOS Risk Manager (EBIOS‑RM) methodology proposed by ANSSI, makes it possible to assess existing controls, identify plausible attack scenarios such as compromise of the backup server or data tampering, and evaluate their likelihood. This approach helps prioritize security measures according to their potential impact on business activities, while ensuring that residual risks remain acceptable with regard to business objectives. 

Monitoring residual risks, those that persist despite the implementation of protection measures, is a natural extension of the risk analysis process. It is therefore essential to identify, document, and integrate them into an ongoing security risk management strategy. By way of illustration, such residual risks may include: 

• Insider threat : A malicious administrator or an employee with privileged access may intentionally alter or delete backups. 
• Compromise of the cloud backup service provider : A compromise of the cloud provider, for example through the exploitation of non‑public vulnerabilities, could allow an attacker to access or manipulate backups while bypassing customer‑side security mechanisms. 
• Compromise of customer (tenant) accounts : Unauthorized access to customer accounts may result in loss of control over backups, including their deletion or alteration. 
• Destruction of backup solution assets : If the backup infrastructure is destroyed (physically or logically), restoring backups may become difficult or even impossible in the event of the loss of critical resources such as: 
  • Backup catalogs / backup tool databases 
  • Secrets such as decryption keys 
• Technical compromise of the backup tool : An attacker may render backups unusable by exploiting technical vulnerabilities in the backup software or the host system, including via low‑level out‑of‑band access mechanisms such as iLO or iDRAC. 
• Compromise of administrative accounts : Even with immutability mechanisms in place, functional compromise of administrative accounts may allow an attacker to disable or bypass protections before, and in some cases after, data is written (retention periods, time‑management mechanisms, etc.). 
• Compromise of the backup tool’s cybersecurity controls : If an attacker tampers with backup protection settings, such as encryption parameters (e.g., encryption_secret), backups may remain unusable.  

Once a secure backup solution is implemented, complement the analysis with periodic audits, Including Red Team Exercises 

In addition to theoretical risk analysis and residual risk monitoring, periodic audits help identify vulnerabilities related to the implementation of the backup solution. Among the possible audit types, Red Team exercises aim to reproduce the behavior of an attacker seeking to destroy backups. These exercises also serve to test the effectiveness of the technical and human measures in place for protection, detection, and response to an attack. 

Conclusion 

Protecting backups against ransomware relies on a holistic approach rather than a purely “product‑based” one : 

• Continuously verifying the reliability of backups to ensure effective reconstruction of the information system; 
• Securing the backup infrastructure by reducing its attack surface; 
• Protecting backed‑up data, with immutability as a priority; 
• Adopting a cross‑functional, risk‑driven approach to security management. 

The level of rigor required for backup security will continue to increase as attackers refine their techniques and strengthen their capabilities.  

Continuous vigilance and adaptation to the evolving threat landscape therefore remain the strongest allies of a resilient backup strategy. 

Cet article Backups: The Last Line of Defense Against Ransomware Part 2  est apparu en premier sur RiskInsight.

This article presents four complementary approaches to strengthening end-to-end backup security: 

1. Continuously ensuring the availability of usable backups 
2. Strengthening the security of the backup infrastructure against attacker takeover 
3. Protecting backups against logical destruction 
4. Identifying residual risks in light of the measures implemented 

This article is published in two parts: the first focuses on approaches 1 and 2, followed by a second publication covering approaches 3 and 4. 

The recommendations presented do not replace those set out in ANSSI guidelines, which define the fundamental principles of backup [2] practices. 

Figure 1: Strengthening Backup Security Through Four Approaches 

1. Continuously ensuring the availability of usable backups 

To guarantee the availability of usable backups, it is essential to apply fundamental best practices. 

Ensuring backup completeness and consistency 

In the context of a ransomware attack, the primary objective of backups is to provide a reliable data source enabling the reconstruction of the information system. Backups are truly effective only if they contain all the elements required for full recovery. This notably includes businesscritical data, configurations of business applications and systems, installation sources, as well as critical operational data such as password vaults, licenses, and operational documentation. 

Backup completeness alone is not sufficient. The need for data consistency points across backups originating from different sources (e.g., a document management system (DMS) database and its associated files) must also be taken into account. Conducting a preliminary analysis helps facilitate data resynchronization across different repositories during the recovery phase. 

In addition, it is necessary to maintain backups of the infrastructure itself to enable identical reconstruction. These backups must include the backup catalog, software installation sources, encryption keys, and all other required secrets. A copy of configuration parameters should be stored in a separate location, such as an offline environment, distinct from the primary infrastructure, in order to limit the risk of a shared compromise. 

According to the Cyber Benchmark conducted by Wavestone across more than 170 assessed organizations, approximately 90% of the organizations observed perform regular data backups. 
Among organizations that perform regular backups: 

• Approximately 65% conduct restoration tests 
• Approximately 20% perform business data consistency checks 

In this context, various controls must be defined and implemented on a regular basis. 

Testing Backup Reliability Through Regular Controls 

A first level of control aims to ensure that backups are effectively performed and remain usable. This can be based on the application of daily verification procedures relying on evidence such as reports, logs, and alerts. These checks may be manual or (semi) automated. However, an additional human review remains necessary to ensure that indicators and alerts are not misleading, particularly in the event that monitoring and control mechanisms have been compromised or disabled by an attacker. 

This first level also includes periodic restoration tests, carried out on representative scopes, in order to verify, where possible with the involvement of application or business subject-matter experts, the integrity and completeness of the data required for business recovery. 

The second level consists in ensuring that first-level checks are properly applied. It relies on independent controls or formalized processes. Dashboards may be used to centralize confidence-level indicators by correlating the results of daily operational checks with restoration test outcomes. 

Once the reliability of backups has been established, restoration processes should be optimized by regularly testing them and ensuring their effectiveness. 

Industrializing Restoration Processes to Optimize Recovery Time in the Event of a Compromise 

To reduce recovery time following a compromise, it is essential to industrialize restoration processes at scale in order to support mass recoveries. This requires preparing these processes in advance, testing them regularly, and adapting them to different destruction scenarios. 

As the restoration phase of an information system may extend over several weeks, or even several months, it is necessary to increase backup retention periods for the data to be restored, in order to prevent their loss through overwriting or premature deletion. 

Restoration processes must also include mechanisms to rapidly assess the state of backedup data by identifying, based on indicators of compromise, data that has been compromised, modified, or corrupted, so as to effectively target the appropriate restoration points. 

Integrating the Risk of Backup Compromise into the Restoration Strategy 

To ensure reliable recovery following a compromise, it is essential to account, within the overall restoration strategy, for the risk of alteration or manipulation of backedup data. This involves addressing the risk of data alteration or manipulation occurring upstream of backup processing by the backup agent, for example: 

• Being able to rely on full backups created prior to the attacker’s intrusion, as identified during the initial investigations. In such cases, the backedup data can be considered uncompromised and used to rebuild systems and applications. 

When restoring unaltered application or system components that are not reinstalled from trusted sources, the restoration process must also include the application of security patches and hardening measures to prevent any subsequent compromise. 

The backup process alone cannot prevent potential data compromise before the data is handed over to it. Depending on the context, additional measures may be implemented, such as: 

• Protecting data integrity through system-level mechanisms and/or cryptographic means; 
• Detecting data alteration through application-level validation, monitoring of “canary files” data, or the use of an EDR (Endpoint Detection and Response) solution. 

These topics must be addressed in addition to backup protection measures. 

Extending Backup and Restoration Best Practices to Cloud Environments 

Finally, the backup rules defined for onpremises environments must be replicated and adapted to cloud environments. 

According to the Cyber Benchmark conducted by Wavestone, approximately 25% of the organizations observed have a regularly reviewed and updated backup policy covering both onpremises and cloud environments. 

In addition, around 29% of organizations externalize a backup of their cloud data to another region or to an onpremises environment, ensuring resilience against cyberattacks and regularly testing this process. 

Beyond the usability of backups, securing the infrastructure that hosts them represents an equally critical challenge, one that is sometimes insufficiently addressed. 

2. Strengthening the security of the backup infrastructure against attacker takeover 

Before considering more advanced mechanisms, it is important to recall that effective backup protection first relies on best practices for securing the backup infrastructure, notably those documented by ANSSI3. A compromise of this infrastructure could indeed result in the alteration of backups (encryption, destruction, etc.). 

Ensuring Defense in Depth for the Backup Infrastructure 

These best practices include segregating production and backup environments, using dedicated administrative accounts, and hardening infrastructure components, particularly through the application of ANSSI hardening guides applicable to Windows, Linux, and other systems. They also apply to backup agents, which may constitute a propagation vector toward production systems. 

In addition to hardening measures, the backup infrastructure must be subject to both technical and cybersecurity monitoring. 

Implementing technical and cyber monitoring of backup infrastructures 

Technical monitoring of backup infrastructures helps ensure their proper operation and detect any anomalies. The effective handling of detected anomalies must be regularly reviewed. 

Cybersecurity monitoring of the backup infrastructure relies on appropriate logging and traffic analysis. It must be capable of detecting the main attack techniques observed in the wild. 

Maintaining Threat Intelligence Focused on Backup Systems 

Threat intelligence specifically targeting backup systems must be maintained, beyond the technical vulnerability monitoring performed as part of maintaining the backup infrastructure in a secure operating condition. This threat intelligence should cover attack techniques and tactics used against backup infrastructures, in order to anticipate potential attacks and adapt protection, detection, and response capabilities accordingly. 

Despite the measures implemented to prevent the compromise of backup infrastructures, the risk of logical destruction remains and must be anticipated. 

Reference

[1] Wavestone, CERT

[2] ANSSI, Sauvegarde des systèmes d’information

[3] ANSSI, Sauvegarde des systèmes d’information

Cet article Backups : The Last Line of Defense Against Ransomware – Part 1  est apparu en premier sur RiskInsight.

On 17 April, the ANSSI published the first doctrinal documents concerning remediation, which is defined as the project to regain control of a compromised information system. These documents are the fruit of the Agency’s experience in supporting victims of security incidents. 

This corpus consists of three sections: strategic section, an organisational section, and a technical section. Currently, the technical section focuses on the remediation of tier 0 of the Active Directory1, or core of trust. This section will be supplemented with additional documents in the future to enhance its content.  

The approach proposed by ANSSI (E3R) is divided into 3 stages: 

1. Containment of the attacker 
2. Evicting the intruder from the heart of the IS 
3. Eradicating the adversary’s strongholds 

These stages are illustrated by 3 typical remediation scenarios, each with increasing ambition levels based on the urgency of the restart and the costs incurred by the long-term damage resulting from the attack: 

1. Restore vital services as quickly as possible 
2. Regain control of the IS 
3. Seize the opportunity to prepare for long-term control of the IS 

The publication of this corpus is a timely step in the reflections and projects currently being carried out by many public and private players, with a view to strengthening their resilience in the face of a successful cyber-attack that would compromise or even destroy their Information System on a massive scale. 

In practice, the time required to establish a proven remediation system extends over several years for most players, rather than just months. This timeframe may be out of sync with the evolving threat landscape and the regulatory deadlines imposed on certain entities.  

There are several reasons for this, which vary from one player to another. However, there are three key factors which contribute to this variation:  

1. Awareness of cyber risk is growing; however, many decision-makers still lack adequate understanding. Balancing immediate priorities with long- term preparation in the face of potential compromises often leads to difficult decisions regarding the allocation of valuable human and financial resources.  
2. The interruption of an organisation’s activities following an IT disaster has historically been dealt with using Disaster Recovery Plans. Their advantages and limitations in terms of remediation are still poorly understood within organisations: 
   1. Depending on the recovery principles adopted, they may offer advantages in terms of IS recovery sequencing know-how (similar to an electrical shutdown/restart), capabilities for unitary and grouped reconstruction, restored data resynchronisation and reconciliation, among others.
   2. Remediation efforts can leverage this know-how, provided it has not been lost because of the adoption of new solutions (e.g., active/active backup) or when a ‘debt’ in terms of maintaining operational conditions and DRP exercises has built up. 

Nonetheless, these plans also have significant limitations. Their architecture relies on technical interconnections and data replication with backup infrastructures, which can inadvertently propagate compromises. Furthermore, while their relevance is proven in a deterministic context (where a given disaster corresponds to a given solution and plan), their effectiveness becomes much less certain when confronted with the diverse characteristics and possibilities of evolving cyber attacks  

This calls for a hybrid approach involving operational, DRP and cyber resilience players. This can be facilitated or hindered depending on the governance that has been put in place between these populations. 

To accelerate the necessary rise in maturity of players on the subject of IS remediation following a cyber-attack, several approach can be considered. Outlined below are four potential strategies, and the subsequent information will provide a more detailed explanation and elaboration for each approach. 

1. Helping decision-makers to understand the specific nature of cyber risk; 
2. Anchoring “compromise by design” in everyday life; 
3. Have several remedial options at your disposal; 
4. Sharing and capitalising on feedback. 

Helping decision-makers understand the specific nature of cyber risk 

 The vast majority of players do not totally rule out the possibility of being vulnerable to a successful cyber-attack that would paralyse their activities through the logical destruction of their IT assets. 

On the other hand, a significant proportion of players have not yet grasped the fact that their existing IT backup resources are rarely adapted to the specific characteristics of this type of attack. A cyber-attack can jeopardise the availability and non-compromise of operating and administrative resources, right down to the workstations of those involved in IS recovery. The timeframe for remediating an Information System (IS) that has suffered extensive destruction due to a cyber-attack is typically considerably longer compared to the recovery time communicated to the business in the event of a physical disaster. 

A number of players have not yet fully assessed the impact of the cyber threat on their ecosystems, for example: 

• If their first-tier IT service providers (outsourcer, cloud service provider, etc.), or even higher-tier providers, are themselves affected by a successful destructive attack; 
• If a player is the victim of a cyber-attack, whether proven successful or not, its partners who have knowledge of the attack will be able to isolate it unilaterally for protection purposes. 

The awareness of an organisation’s decision-makers of the cyber risk, its systemic implications and the impact on its business must be developed. In the financial sector, the DORA regulations, or their equivalents in certain non-European countries, as well as the stress tests announced by the European Central Bank for 2024, should contribute to this. 

For many decision-makers, too many technical words are used to describe the risk of cyber destruction. Unlike compliance issues such as the RGPD, which can be understood by the uninitiated, this risk is perceived as a matter for technical experts. Nevertheless, the subject is increasingly being addressed at executive committee level, for example through the presence of the CISO on the Executive Committee and/or through external speakers with experience in acculturating senior management. 

Anchoring “compromise by design” in everyday life 

By considering the possibility of an IS compromise that could result in its destruction and incorporating this perspective from project design to operational activities, the resilience capabilities of the IS can be significantly bolstered.  

From the earliest stages of a project, the business units can be called upon to identify and evaluate, with the support of the technical teams, cyber-resilient design solutions. These may include: 

• To use suppliers of nominal solutions that are technically independent of the organisation’s IS, so that its activities are not based exclusively on it’s IS; 
• To host and operate backup solutions outside the organisation’s IS; 
• Use cyber-resilient architecture models based on an on-premises catalogue or hosted in the Cloud. They are also designed to allow their resilience to be tested while limiting the impact of tests on production; 
• Designing projects that enable operation in degraded mode via : 
  • Periodic extraction of business data in office format, outsourced and protected in an external file storage service; 
  • The ability for applications (and services such as restoration) to operate without certain cross-functional services such as the AD authentication repositories via local backup accounts, etc;  
• Drawing up downgraded business procedures based on downgraded IS resources such as those defined above. 

In addition, the appropriateness of certain practices, although incompatible with the objectives of standardisation and industrialisation, can be considered at the technical design stage, in particular: 

• Encouraging diversity of technologies to limit the exploitation of a vulnerability. 
• Limiting the dependency of applications on cross-functional information systems, so that they can be rebuilt and made operational more quickly. 

During the acceptance phase, business operations in degraded mode and the ability to rebuild an application can be systematically tested before going into production. This test can be reviewed if necessary for each major change. It should be reiterated periodically through exercises that will enable remediation capabilities to be tested and enhance the skills of the various operational players. 

Moving beyond the project phase, the integration of asset reconstruction practices into Business As Usual (BAU) operations enables better mastery of these practices. This, in turn, benefits a larger number of participants in the event of remediation, for example; 

• Reconstruction, once or twice a year, using non-IS resources (e.g., Cloud services or off-line resources), of workstations used for administrative tasks and/or critical activities; 
• Reconstruction, once a year, of infrastructures essential to the recovery of the IS (e.g., restoration infrastructures, core of trust, virtualisation base, etc.), to be determined on the basis of the threat and risk analysis; 
• Development of CI/CD practices on a daily basis, particularly in Cloud environments, in order to automate the recreation of servers to apply changes to them, such as version upgrades or patches. 

Finally, keeping the IS map (including its interconnections with partners and the Internet) and its interdependencies up to date daily is a key factor in remediation, which must be supported by appropriate processes, tools (cyber-resilience) and controls. 

Having several remediation options at your disposal 

Given the difficulty of predicting the course of a cyber-attack and the evolution of its impact in advance, the preparation of a plan requires a balance to be struck between two excesses: 

• Developing reconstruction solutions tailored to too few attack scenarios, with the inherent risk of deadlock, 
• Or, on the contrary, seek to cover all possible scenarios, at the cost of a significant loss of efficiency. 

An updated risk analysis of possible attack scenarios, based on a threat watch, makes it possible to prioritise those to be covered, such as those with the highest probability of success and the greatest impact in the context of the organisation.  

This analysis makes it easier to identify the assumptions that will be used as inputs to the development of plans. For example ; 

• Just a year ago, planning for the industrialised reconstruction of the virtualisation layer of physical servers did not appear to be a necessity for most players, but it has now been identified as essential. 
• The destruction of Cloud resources through the compromise of access to the tenant (master accounts or API access) or even the compromise of the Cloud provider itself, appears to be a new risk that needs to be considered in the Cloud resilience strategy of several players. 

Once the working hypotheses have been chosen or ruled out (e.g., the types of components and technologies impacted, the residual capacities of the malicious code once its means of interacting with the attacker have been cut off, etc.), it is possible to assess the relevance of the various possible means of reconstruction and to prioritise the work more effectively. The following are possible means of reconstruction.  

• Restore systems and/or business data from backups, if necessary, in an isolated environment (e.g., from snapshots, offline or “immutable” backups); 
• Cleaning up restored environments that may have already been compromised when they were backed up (e.g., Using antivirus software for office files and systems that may have been compromised, using an EDR on systems that have been restarted in an isolated environment, or using solutions that can clean up the backed-up image of a virtual server directly); 
• Reinstallation of compromised technical layers (e.g., OS, middleware, etc.); 
• Replenishment of virtual infrastructures (e.g., Terraform, etc.); 
• Strategies and solutions that can cover both the risk of a conventional disaster and a cyber disaster (e.g., a backup IS that is independent of the nominal IS, with business data refreshed by a device that maintains technical watertightness). 

This assessment should lead to the development of a “catalogue” of remediation methods, the application of which should be contextualised at the time of the attack. As a complement to each reconstruction solution in the catalogue, the identification of an alternative – perhaps less industrialised – solution will enable us to deal more effectively with the vagaries of the attack context. 

Sharing and capitalising on feedback 

To gain maturity and efficiency in remediation more quickly, market players benefit from capitalising on the experience of others. 

This may involve capitalising on: 

• Studies, such as the body of doctrine published by ANSSI; 
• Direct exchanges with peers or via third parties; 
• Working groups in which its ecosystem of partners will be represented if possible. 

The feedback to be sought can relate to the specificity of the cyber context in remediation but also to more traditional aspects linked to the reconstruction of an IS such as: 

• The methods and approaches used; 
• Proven market solutions (beyond promises);  
• Performance achieved (reconstruction times)  
• Costs;  
• Logistical and HR aspects (similar to crisis management);  
• More functional aspects such as data reconciliation, following different restoration points and lost flows with third parties. 

Other articles on the subject of remediation :

Surviving an Active Directory compromise: key lessons for improving the rebuilding process

Cyber-attacks: what are the risks for backups and how can you protect yourself?

Active Directory rebuild: approaches to quick Active Directory recovery

Next on https://www.riskinsight-wavestone.com/ : workstation remediation

Cet article  « Compromise by design » or how to anticipate a destructive cyber attack est apparu en premier sur RiskInsight.

• In this case, FBI used Open-Source INTelligence (OSINT) techniques.

Overview and use cases

Behind the myriad of acronyms related to OSINT (SOCMINT, GEOINT and so on) lies a single methodology: identify and consolidate a variety of information related to a target, using publicly available tools and services. Similar to technical audit activities, the underlying approach will be iterative, with its share of false positives and dead ends.

Regardless of the information sought, the techniques used can range from complete passivity (search without being authenticated, without leaving any trace) to a much stronger interactivity (sending emails, subscriptions, or interaction on social networks …).

Although this specific field of cyber is rapidly evolving, the constants will be:

• Remain humble and critical about the quality of the sources and information retrieved.
• Be aware of the traces generated and left as a result of our research.
• Consider legal aspects, including research and retention of personal data.

At present, the possibilities offered by OSINT methods and tools make it possible to consolidate information in various fields:

• On the organizational and human side, it will be mainly financial investigations, obtaining a consolidated view of the competition, headhunters, or lawyers.
• On the technical side, the objective may be to conduct a proactive watch on actors and threats, or to obtain an overview of an organization’s exposure on the Internet, looking for technical entry points or leaked data.

In both cases, attackers deploy similar methodologies to achieve their goals, whether it’s doxing, blackmail, fraud, or simply the reconnaissance phase of a larger cyber attack.

What market for OSINT?

The OSINT market is growing rapidly (+20 to +25% per year on average according to studies[2]).

These include players related to marketing solutions, business intelligence and homeland security; as well as players related to cyber threat intelligence or the provision of more OSINT-specific solutions.

• Marketing intelligence platforms, such as Brandwatch, Cikisi or Digimind, which are able to analyze what is being said about a brand on social networks.
• Players specialized in consulting and investigations in the field of economic intelligence, such as Avisa partners/CEIS, ADIT or Axis&Co.
• Homeland security oriented solutions, with players:
  • French, such as Thales with OSINTLab used by the Gendarmerie Nationale or Airbus ;
  • foreign, such as the American Palantir, used temporarily by French governmental administrations, while waiting for a sovereign alternative encouraged by the public authorities[3].
• Cyber threat intelligence actors:
  • working more classically on attacker groups, trends, vulnerabilities, such as Sekoia and Tehtris;
  • having the ability to automate searches, such as information leaks based on keywords (e.g., CybelAngel) or the digital footprint of a set of people (e.g. AnozrWay).
• Providers of specific commercial solutions, used in particular for:
  • automated monitoring of Web data sources, or even the Darknet, such as Fivecast Onyx or Aleph Networks;
  • transcription/indexation of speech from videos posted online, such as Chapvision and natural language processing, such as expert.ai;
  • investigation assistance, such as Maltego or Osidian.

Tools

The panel of essential OSINT tools is constantly changing and can be largely adapted according to the objectives set. We mainly count the following typologies:

• Public tools, such as major search engines (Google, Yandex, Bing …) and their reverse lookup services, storage and archive sites (Pastebeen, WaybackMachine …), tracking services (airplanes, boats …) as well as some social networks.
• Specialized SaaS services, often with trial offers or free versions, but which often limit the quantity and quality of the information presented. The use cases can be oriented towards people search (Lusha, Kaspr, Anywho, Hunter.io …), face search (TinEye, PimEyes), technical information search (Shodan, IntelX.io, Onyphe, BinaryEdge), or even leak search (HaveIbeenpwnd, DeHashed …).

Various toolkits, including complete frameworks (Maltego, Lampyre), as well as a large number of open-source tools and scripts (GHunt, Maigret, Phoneinfoga …). Most of these tools will be based on automation via Selenium and will be confronted with the API limitations and possible countermeasures of the targeted services.

Within the framework of an investigation, the key will be to position our needs on the triptych Quality of information / Price of information / Simplicity of access (speed, specific developments…), and to adapt the choice of tools accordingly, given the time and financial means deployed.

The legal framework surrounding OSINT activities is often vague and may depend on the country or geographical area, the durability of certain tools and platforms is never guaranteed. This is why it is useful to have a redundant toolbox and to update it regularly. As an example, the technical information search site Spyse, mainly hosted in Ukraine, has seen its services interrupted since March 2022.

How to protect yourself from malicious use of OSINT?

Three pieces of advice can be given to actors wishing to limit the exposure of their digital footprint:

1/ (Have) your digital footprint searched on the Internet and clean up what can be cleaned up (close unnecessary accounts, do not expose unwanted information – especially using privacy settings).

2/ Diversify and hide your logins and passwords (e.g. avoid leaving information that can be linked to your identity in the accounts you choose or that are offered to you by default).

3/ Before posting public content, think about whether its content could be exploited against you; talk about this subject with your friends and family, reminding them that the Internet does not forget.

What regulatory framework applies to OSINT?

There is no specific regulatory framework applicable to OSINT in France, which is also generally the case abroad. The existing legal framework is however applicable, in particular:

• The Godefrain law, which will repress the fact of accessing, fraudulently remaining in an information system, extracting, holding, or fraudulently reproducing its information. The fraudulent character can in some cases consist in bypassing a simple security mechanism or in downloading files exposed by mistake. It is assessed, on a case-by-case basis, by judges whose level of familiarity with digital technology may vary.
• The General Data Protection Regulation (GDPR). For example, the CNIL condemned in October 2022 the company ClearView AI, champion of the indexing of face photos on the Internet. Clearview announced a target of 100 billion indexed photos, which was 10 times more than in 2020.

In addition to the regulatory framework applicable to the countries concerned, whose jurisprudence may diverge, it is desirable that the players conducting OSINT activities adhere to a framework of good practices. In this respect, we can mention the Berkeley Protocol, even if it is more specifically oriented towards investigations.       

What can OSINT concretely bring to cybersecurity?

The proliferation of OSINT techniques and tools accessible to the greatest number of people can facilitate its use and its industrialization for offensive purposes, with regard to information systems, people and organizations.

Putting oneself in the shoes of an attacker, by using OSINT as he does, is a way to better protect oneself. This is how OSINT finds its place in certain risk analyses, awareness-raising initiatives for people at risk, or RedTeam missions. But always within a legal and ethical framework to which the attacker will not adhere.

_________________________________

[1] Detail of the report https://heavy.com/wp-content/uploads/2020/06/merged_87745_-1-1592492707.pdf

[2] Including Open-Source Intelligence (OSINT) Market by GMInsights https://www.gminsights.com/industry-analysis/open-source-intelligence-osint-market and Open-Source Intelligence (OSINT) Market by Market Research Future https://www.marketresearchfuture.com/reports/open-source-intelligence-market-4545

[3] “Chapsvision annonce l’acquisition d’Ockham Solutions après avoir finalisé celle de Deveryware” https://www.aefinfo.fr/depeche/680407  and “Une alternative française au logiciel d’analyse de données de Palantir est possible, d’après Thales” https://www.usine-digitale.fr/article/une-alternative-francaise-au-logiciel-d-analyse-de-donnees-de-palantir-est-possible-d-apres-thales.N1020429

Cet article OSINT or Intelligence 2.0 est apparu en premier sur RiskInsight.

Typically, one would use key words to find out information about a topic they are interested in.  For example, if one wanted to improve their tennis serve, they would probably search for “tennis serve tips”, which would give a number of links to articles based upon the terms provided. Search engines archive information collected throughout the internet, indexing information so it is readily available to comb through. A user will provide a keyword which the engine will then find throughout its indexes, returning results based upon relevance and algorithms. Search engines store all publicly accessible information in a website, like things hidden in the code that are not secured.  In addition to searching for key terms, search engines provide a number of more advanced operators to take advantage of, which is exactly what Google dorking takes advantage of. For example, the operator ‘site’ will focus a search on a specific website instead of every site indexed by the search engine.

Wide scale security events using Google dorking has occurred recently and has been widely reported on.   Two notable examples include the data leak of a French political party’s data, which was found on the site of its webhost using “dorks” of the type “Index of /” and the discovery of numerous websites used by the CIA for communication, leading to numerous executions of agents working for the US.

To give an example of a specific search that uses Google dorking, the inquiry “inurl: files intext:nationality filetype: xls intext: <first name or last name type>”is likely to find Excel files that contain individuals’ information with columns displaying  name and nationality. At the same time, a single well-chosen keyword—for example, the name of an enterprise application searched on the Internet or the word “salary” searched on the company intranet—can be enough to find highly sensitive information.

Search engines internal to certain websites can also be exploited.  For example, websites containing application source codes (e.g. GitHub), technical forums for software publishers, or job posting websites containing descriptions of sensitive technical environments can be ripe for using Google dorking to find exploitable information

Google dorking has reached an apex of public accessibility because of numerous tutorials postedonline, specialized, private search engines (e.g. startpage.com) and websites listing thousands of “dorks” (e.g. Google Hacking Database) listed by specific use case (e.g. finding files containing passwords).

Google dorking is typically performed manually but able to be automated with “dork scanners” such as “Zeus-scanner” or with the help of PowerShell tools (PnP-PowerShell) for searches in Office365.

To guard against exploitation of internal search engines, organizations can:

• Use Data Loss Prevention software and services to detect data leakage of sensitive information, including tools that search non-indexed websites, like the Dark Web.
• Implement Data Classification and Governance procedures, including oversight of how data is shared, like withOffice365 Groups, starting with data that is most critical to business operation and would lead to the largest risk events (e.g. sensitive trade groups, client data, HR information, etc.)
• Appropriately oversee outsourced activities with a Security Assurance Plan and raise providers’ awareness of the importance of the adequate protection and nondisclosure of the information accessible to them. When possible, require evidence of data destruction after a contract has expired
• Supervise the transfer of sensitive information to parties that do not always possess Synchronous Serial Interface (SSI) protection capabilities (on their company intranet or on the Internet) equivalent to the organization’s own capabilities

Organizations can also take measures to limit the impact of a known data leak:

• Develop a process for managing identified leaks, including actions to be taken for search engines and websites that have indexed the leak (e.g. Google search engine optimization (SEO) management)
• Have procedures for security incident management including data breach (with regards to GDPR) and crisis management activities,  noting the potential need for notification of regulatory authorities and impacted individuals.
• Have a monitoring procedure and tools in place for social media networks, developing prepared responses for engaging with individuals on these platforms when dealing with a crisis

Google dorking can be leveraged by an organization to test out the security of its own systems, such as during, security audits or Red Team activities that aim at thinking from a malicious agent’s perspective to discover—before the agent—the gaps that could be exploited to cause harm to an organization.  Google dorking is a powerful technique bad actors are using to exploit rarely seen gaps in an organization’s architecture, and the possibility of this technique’s use should be kept in mind when assessing an organization’s information security risk.  It is one of the many examples of ways cybercriminals continue to evolve in their activities today, and highlights the need for an organization’s continuous evolution in how it handles security.

Cet article Dorking – exploiting search engine capabilities to discover security gaps est apparu en premier sur RiskInsight.

Deux actes médiatisés ces dernières années l’illustrent parmi bien d’autres : la fuite des données d’un parti politique français retrouvées sur le site de son hébergeur, en utilisant un Dork du type « Index of /», ou la découverte, par des services de contre-espionnage, de sites internet servant pour la communication entre une agence étatique et ses informateurs, entraînant la mort de plusieurs dizaines d’entre eux.

Sur Internet, la pêche aux « Dorks » s’exerce via des moteurs de recherche tels que Google et Bing mais également sur des moteurs hors US/EU qui, tout comme les sites d’archivage de pages web, sont susceptibles de conserver des informations retirées des bases d’index des moteurs de recherche classiques.

A titre illustratif, la recherche suivante : « inurl:files intext:nationalité filetype:xls intext:<un prénom ou un nom de famille type> » entrée sur un moteur de recherche largement utilisé, est susceptible de retrouver des fichiers Excel où figurent des informations nominatives mentionnant la nationalité de personnes. Cependant un seul mot bien choisi, par exemple le nom d’une application métier recherché sur Internet ou le mot « salaire » recherché sur l’intranet, peut suffire à pêcher des informations très sensibles.

Les moteurs de recherche internes à certains sites peuvent être également exploités. C’est le cas, par exemple, des sites spécialisés dans la mise en ligne de codes sources (ex : GitHub) ou de morceaux de textes (ex : PasteBin), des sites de forums techniques d’éditeurs de logiciels, ou de sites de CV en ligne contenant des descriptions parfois très précises sur des environnements techniques sensibles.

Le « Dorking » est à la portée du plus grand nombre, grâce aux nombreux tutoriels accessibles sur Internet, aux formulaires de recherches étendues (ex : celui de startpage.com) et surtout aux sites référençant des milliers de Dorks (ex : Google Hacking Database) organisés en fonction de l’usage attendu tel que retrouver des « Fichiers contenant des mots de passe ».

Le Dorking s’effectue plus communément à l’aide de recherches manuelles mais est susceptible d’être industrialisé grâce à des « Dork scanners » comme Zeus-scanner ou à l’aide d’outils PowerShell (PnP-PowerShell) pour les recherches dans Office365.

Pour se prémunir de l’exploitation malveillante du Dorking, les organisations peuvent notamment :

• Être en capacité de détecter les fuites d’informations sensibles sur le SI interne ou sur Internet, en examinant par exemple l’opportunité de recourir sur le SI interne à des produits de type DLP et sur internet à un service de veille des fuites d’informations, qui pourra également surveiller l’internet non-indexé, voire le Dark-Web.
• Mettre en place une classification des données et une gouvernance des partages internes (ex : les Groups Office 365) en commençant par les activités les plus sensibles (ex : groupes métiers sensibles, données clients, RH…).
• Encadrer contractuellement et opérationnellement les missions confiées aux prestataires via un Plan d’Assurance Sécurité et les sensibiliser à la protection et à la non-divulgation des informations auxquelles ils peuvent accéder ; lorsque c’est possible, prévoir un PV de destruction de données.
• Encadrer la communication d’informations sensibles aux partenaires sociaux, aux associations, etc. qui ne disposent pas toujours sur leur SI et sites Internet dédiés, de moyens de protection SSI équivalents à ceux de l’organisation ou de l’entreprise à laquelle ils sont liés.

Les organisations peuvent également prendre des mesures visant à limiter l’impact d’une fuite de données avérée :

• Disposer d’une fiche réflexe pour traiter la fuite, incluant la conduite à tenir vis-à-vis des moteurs de recherche et des sites l’ayant indexée (ex : gestion du référencement Google, etc …)
• Disposer d’un processus de gestion des incidents de sécurité, de data-breach (GDPR), de gestion de crise… incluant la notification potentielle aux autorités et personnes concernées.
• Disposer d’un processus et d’outils de veille sur les réseaux sociaux et media avec des réponses préparées.

Cette prévention peut en outre conduire à recourir à la technique du Dorking à des fins éthiques, tels que des audits de sécurité, ou des activités « Red Team » qui visent à se mettre à la place d’un acteur malveillant pour découvrir – avant lui – les failles et les informations qui permettraient de porter atteinte à l’organisation. Néanmoins, en fonction du contexte, il peut être préférable de bien encadrer en amont la communication des résultats de la mise en œuvre de techniques de Dorking, lesquelles peuvent donner lieu à la découverte d’informations personnelles ou/et sensibles, sur des ressources liées à l’entreprise ou à des acteurs externes.

Cet article Le Dorking ou la pêche aux informations sensibles via les moteurs de recherche est apparu en premier sur RiskInsight.

L’IMPORTANCE DU FACTEUR HUMAIN

Selon la légende, un homme déguisé en moine pénétra sans attirer la méfiance dans une forteresse du sud-est de la France (actuel Monaco), une nuit de janvier 1297. Il put ainsi ouvrir à des soldats qui s’en emparèrent facilement. Il en va de même pour des attaques perpétrées à l’aide de dispositifs USB familiers, que l’utilisateur branche en tout confiance sur le port d’une machine.

Une étude publiée au Blackhat USA en 2016 a montré que 45% des 297 clefs USB disséminées sur un campus universitaire ont été connectées à des ordinateurs et leurs fichiers ouverts. Cette étude illustre bien la capacité à mener des attaques efficaces via des clefs USB et pour un coût minime.

Par ailleurs qui n’a jamais laissé un téléphone portable se recharger sur l’un des ports USB de son PC ?

Si la connexion au réseau fait le plus souvent l’objet de nombreuses mesures de sécurité, les autres portes que constituent les ports USB font, généralement, l’objet d’une attention moindre, sur les serveurs, les postes de travail et désormais les tablettes et smartphones qui intègrent la technologie USB On-The-Go.

Les dispositifs USB sont présents partout, tirant partie de l’interopérabilité de l’Universal Serial Bus.

Le revers de la médaille de ce développement historique et de sa compatibilité descendante, est qu’il n’a pas été techniquement conçu “security by design” et que ces dispositifs offrent une large surface d’attaque.

Figure -Vidéo illustrative de sensibilisation sur la sécurité des clefs USB

UN LARGE PANEL D’ATTAQUES RENDUES POSSIBLES PAR L’USAGE (PRESQUE) INCONTOURNABLE DES DISPOSITIFS USB ET AU MANQUE INTRINSÈQUE DE SÉCURITÉ DES STANDARDS HISTORIQUES

Les périphériques de stockage amovibles, clefs ou disques USB, peuvent servir de vecteur à la propagation d’un code malicieux. D’autres types de périphériques USB (ex : webcam, clef 4G) peuvent également intégrer une fonction de stockage amovible, par exemple pour faciliter l’installation du pilote logiciel du périphérique.

La provenance légitime d’une clef USB ne peut garantir entièrement son innocuité, si celle-ci a été compromise en usine ou avant l’envoi aux clients, comme cela a pu arriver récemment à un fournisseur de systèmes de stockage.

Par ailleurs, un périphérique USB d’apparence banale, peut avoir été reprogrammé ou modifié physiquement pour compromettre ou endommager le système sur lequel il est branché, par exemple :

• En se faisant passer pour un clavier et envoyer des commandes au système hôte, lesquelles vont par exemple permettre sa prise de contrôle à distance. Il est à cet effet possible de reprogrammer une clef USB du commerce (voir cas d’usage illustratif dans la vidéo ci-dessus) ou d’utiliser un dispositif ayant l’apparence d’une clef USB classique ;
• En se faisant passer pour une interface réseau et un serveur DHCP/DNS, afin notamment d’intercepter le trafic de l’utilisateur, d’introduire des portes dérobées sur le poste de l’utilisateur, de faire exécuter par son navigateur des codes malveillants sur des sites sur lesquels il est autorisé à se connecter, voire d’exposer un  routeur interne ;
• Pour détruire le système hôte en délivrant au connecteur des tensions élevées.

Une clef USB peut également être utilisée pour attaquer des équipements sensibles déconnectés du réseau de l’entreprise, par exemple des équipements industriels, lorsque celle-ci est utilisée en “navette” avec des postes connectés internet, donc à un attaquant externe potentiel.

Il est également possible de tirer parti du rayonnement électromagnétique qui peut se produire au travers d’un périphérique/câble USB, d’un poste isolé de tout réseau, pour permettre à un code malicieux, introduit via le dispositif USB, d’exfiltrer des informations à quelques mètres.

Les attaques consécutives à la modification de périphériques USB restent encore limitées, assez ciblées et potentiellement très efficaces (ex : Stuxnet en milieu industriel). La mise au point de certaines de ces attaques est facilitée par les sources d’informations, les tutoriels et les outils librement accessibles sur Internet.

L’arrivée de l’USB-C, également utilisé comme alimentation électrique des nouveaux ordinateurs portables, peut contribuer à augmenter un peu plus la surface d’attaque (chargeurs, packs de batterie), tant que la compatibilité avec des standards non sécurisés devra être maintenue pour des raisons de compatibilité descendante avec les autres versions d’USB et dans l’attente de la généralisation de futurs chargeurs sécurisés.

LES CONTRE-MESURES DOIVENT ÊTRE CIBLÉES SUR LES RISQUES LES PLUS ÉLEVÉS (ET DONC ÉGALEMENT SUR L’HUMAIN)

L’évaluation des risques liés aux dispositifs USB doit permettre d’identifier les périmètres du SI et les populations vers lesquels cibler en priorité les contre-mesures :

• Sensibilité des populations (VIP, mainteneurs, administrateurs systèmes …) ;
• Sensibilité de l’équipement sur lequel il est possible de connecter un dispositif USB (poste utilisateur, poste sensible déconnecté du réseau, station d’administration, serveur, équipement industriel …).

La connexion d’un périphérique USB à un équipement passe par un choix humain. Il est donc essentiel de sensibiliser les acteurs, y compris leur management opérationnel, par des actions classiques (supports de communication des risques et des bonnes pratiques, …) voire plus innovantes (ex : disperser des clefs USB témoins remontant une alerte une fois connectées à un poste de travail, effectuer des démonstrations, organiser des jeux de plateau pour entraîner des populations plus ciblées à évaluer certaines prises de risque, …).

Les contre-mesures techniques sont un complément. Leur efficacité demeure toutefois variable.

• Un antivirus pourra le plus souvent détecter un fichier infecté sur un périphérique de stockage USB avec la même efficacité que si ce fichier se trouvait sur un autre espace de stockage. Certains produits pourront n’autoriser la lecture du contenu d’un stockage amovible, que si celui-ci a préalablement été chiffré avec une clef permettant d’y accéder seulement depuis des postes de l’entreprise ;
• Des équipements de ‘sas’ de décontamination peuvent également être utilisés pour sécuriser les échanges de fichiers entre une clef USB et le SI de l’entreprise ;
• Des solutions logicielles permettent de contrôler la connexion d’un dispositif USB à des groupes de postes ou serveurs, en fonction de caractéristiques annoncées lors de son branchement. Il s’agit du moyen le plus répandu pour maîtriser la connexion des dispositifs USB. Cependant, un dispositif USB modifié peut dans certains cas arriver à tromper cette protection logicielle ;
• Le marché propose également des clefs USB avec un micrologiciel sécurisé, qui permettent de s’assurer que celui-ci n’a pas été reprogrammé. Néanmoins, il reste toutefois possible d’introduire dans l’entreprise des dispositifs piégés reprenant ou imitant le packaging extérieur de clefs USB sécurisées ;
• La neutralisation ou le blocage physique des ports USB, en particulier sur les postes les plus sensibles, tels que des stations d’administration ou des stations de conduite dans le milieu industriel, reste toutefois une solution assez efficace pour des périmètres spécifiques.

Nous devrons attendre encore un peu avant de pouvoir pleinement bénéficier d’une sécurité efficace portée par de nouveaux standards USB. En attendant, le parc non sécurisé et le risque s’accroissent. Pour y faire face, ne comptons pas uniquement sur des réponses techniques et ne négligeons pas le facteur humain.

Cet article L’habit ne fait pas le moine – Ou l’importance du facteur humain dans la maîtrise du risque USB est apparu en premier sur RiskInsight.