If I were a cyber attacker, I wouldn’t go after just any user. I’d target privileged users. They are the people who hold the keys to the kingdom, so to speak – the sensitive information, the crown jewels. They have supervision and control over the enterprise’s servers, endpoints, databases, and customer and employee information. And they present the most efficient way to get to the heart of any enterprise.
Privileged users might be domain administrators, database administrators, network administrators. Depending on the size and type of the organization, their numbers could range from a dozen, to a hundred, or even thousands of people.
It’s not hard to get past these users. I would start by going through LinkedIn or other social media and public sites to know exactly who they are and how I could get to them. And then I would send them an email, perhaps impersonating someone they trust or defer to, or use some other technique to run something executable on their machines.
After I find my way into their machines, I could then completely remotely control the endpoints and do whatever it is that they, in their privileged status, can do. Once I get my hands on all the privileged information they hold, then it’s pretty much game over for that enterprise.
The hacker wins.
Of course, many people would say privileged users are, by the nature of their jobs, technologically knowledgeable and cognizant of risks. So why would they fall victim? The reality is, at the end of the day, they are still human. And I think we all agree that humans are the weakest security link in any organization.
What, then, is a foolproof way to manage this risk?
Two platforms
Prior to establishing my company, I spent six years with the Israeli Ministry of Defense performing cybersecurity functions. My colleagues and I were very much aware of this problem.
We also knew that even the most sophisticated, high-grade, latest endpoint security solutions would never be enough to protect the organization. All the efforts to detect hackers and stop them from doing what they intend to do prove futile because in the end, it is humans themselves who make machines vulnerable to attacks.
The apparent solution: Give each privileged user two separate machines: One for sensitive crown jewels, and another for internet access and other materials. The two-device solution is a very common approach used not only by military but by enterprises around the world. It’s also very cumbersome, to say the least, because it means people have to switch between two machines all the time, and even lug two laptops around. Believe me, I did this for my work as developer at the time. I was not happy with it but felt we had to do it to keep our sensitive information safe.
This created a new pain point of inconvenience – and spurred in me an idea I eventually pursued, honed, tested, and improved at Hysolate.
Can you trust your OS?
Enterprises in any industry try to protect their crown jewels in a myriad of ways. In addition to using security tools and agents, they also impose limits on what even an administrator can do – you can’t visit this URL, you can’t install this app, you can’t use this drive.
But there is an inherent tradeoff in all this. Your administrators will feel restricted by all the limitations. Their productivity will take a huge hit, while their frustration level rises. And many will eventually try to find a workaround – a way to do what they need for their jobs, anyway. When they do this, especially given this privileged status, you are vulnerable all over again. Trainings aimed at educating users abound, but they are not fool-proof.
Not even the most experienced administrator would be beyond believing an email from their CEO asking them to open an attachment or click a link because she needs their help.
Meanwhile, more and more security gaps and holes will emerge, and the enterprise will never be able to guarantee that it will be secure from cyber risks.
So, I go back to the principle of isolation – working on two distinct systems. But not two separate devices.
Instead, you can have multiple virtualized OSes on the same endpoint device. If you run your sensitive information in a dedicated, privileged OS that is sandboxed, everything you do on it is completely isolated from the rest of the world. And then you can have another virtual OS for Internet access and all other corporate work.
Your users won’t have to switch between two machines anymore, or carry multiple devices. They get a seamless transition from one OS to another. We call this approach software-defined endpoints. It’s a win-win situation: You can rest easy because even if your privileged users slip up and fall prey to phishing attacks, for instance, your crown jewels will remain protected because they are in another fully isolated OS. And your users gain the freedom to be so much more productive and work in the ways they are accustomed.
Enterprises’ efforts to anticipate attacks and educate privileged and other users about how not to fall prey to cyber attacks will never end, because hackers are ingenious and will always come up with innovative, clever ways to get into their endpoint devices. It’s a cat-and-mouse game that will never end. Only complete OS isolation paired with user productivity enhancements will address this risk, once and for all.
Tal Zamir is CEO and co-founder of Hysolate.