Raiders of the Lost Datastore: A Tabletop Exercise

‍A note from Andy Ellis

Every security team has its horror stories of bad things that’ve happened to them. If you’re fortunate, you can learn from other teams by listening to these stories.  If you’re really clever, you can use those stories to run your own tabletop exercises, learn from them, and hopefully teach your team some lessons along the way. 

YL Ventures is curating incidents for you to use as tabletop exercises. Some of these stories are true.  Some have the rough edges filed off of them. But all of them are useful as the seeds of tabletop exercises for you. Each exercise has been posted on one of our portfolio company’s blogs, and they’ve responded with how their solution might help you in that scenario. 

‍

Raiders of the Lost Datastore

Looking for a tabletop exercise? Here’s one for you to use for your next annual exercise, whether it’s for PCI, SOC2, or just because you like practicing incident response.
‍

Scenario: It’s a normal day, when you get the dreaded notification: some of your production data has leaked. Perhaps you learned about it after Brian Krebs called asking for a comment. Maybe the adversaries sent you a ransom note, or simply went ahead and published an excerpt of the data. Now you have to find out how it happened. 

On analysis, you confirm that the data is legitimately yours. It matches active records in your production database. This isn’t a drill!

It’s time for forensics, and looking at your cloud audit trails reveals a surprise. When the cloud team went looking at access logs to the production database that seemed most likely to be the source of the data leak, they found…another datastore that was almost identical to the production system!

Apparently, last year, in order to test out a new data analytics platform, the analytics team had created a new environment. To populate this development environment, they cloned an existing data store, but didn’t bring over any of the access controls for it.

This is the datastore that was compromised. Without those access controls in place, an adversary who exploited what should have been a minor vulnerability was able to exfiltrate your crown jewels.

‍

Eureka to the Rescue!

Eureka’s DSPM platform equips you with the capabilities you need to navigate this crisis with confidence. Let’s explore how, together, we can respond to and mitigate the fallout of this data breach scenario and safeguard against it happening again.

‍

1. Impact Assessment

First, it’s critical to evaluate the extent of this breach’s impact. Eureka offers the tools needed to swiftly conduct a comprehensive impact assessment, easily meet compliance requirements and generate incident reports.

• ‍Identify the type, duration and amount of exposed data – Eureka’s meticulous classification of the compromised database sheds invaluable light onto the sensitivity level, amount and types of data that have been exposed in order to accurately quantify the impact of the compromised database.

2. Additional Forensics Efforts

Moving beyond the initial assessment, Eureka can help you dive deeper into the forensic landscape to uncover hidden vulnerabilities and shed light on other potential breach vectors.

•  Identify security gaps – While we’re at it, it would be wise to pinpoint the primary entry point of the breach and any secondary infiltration points that may exist within the compromised database. From misconfigurations to patch management issues and improper access controls, Eureka can help uncover these vulnerabilities and compile a list of potential entry points that contributed to the breach.
• Assess user access – By reviewing user permissions and access patterns, Eureka can help you determine how the attacker gained access to your crown jewels. Whether through compromised accounts or other methods, you can identify unauthorized access and potential exfiltration attempts.
• Monitor for suspicious activities –  Analyzing user activities can help identify potential threats and provide the insight you need to take proactive measures against them. Eureka's monitoring capabilities enable you to detect abnormal user behavior that may indicate ongoing unauthorized access to the datastore.‍
• Identify local accounts – Finally, it’s important to track unmanaged access to sensitive data. Eureka can identify all accounts and their permissions to help you secure them and prevent further exploitation. Eureka flags local accounts within the database, especially privileged accounts that are often ignored or forgotten, like "root" or "temp," which can pose serious security risks if compromised.

3. Residual Impact  and Additional Compromised Assets

After a breach, understanding the residual impact and pinpointing additional compromised assets is crucial for uncovering hidden vulnerabilities and preventing further data loss or unauthorized access. Not only does this help uncover hidden vulnerabilities,  it critically also prevents further data loss or unauthorized access. Swiftly identifying these assets enables  organizations to carry out targeted remediation efforts, ensure regulatory compliance and reinforce trust with stakeholders through transparent and effective incident response.

Beyond assessing the immediate impact, you’ll want to delve into the broader ecosystem to identify interconnected assets that might be at risk. This involves scrutinizing data stores that share similar datasets or replicated without adequate security controls. 

• ‍Lateral Movement Analysis – Eureka's classification insights can identify secrets or compromised credentials that could facilitate lateral movement within your environment. This awareness and understanding of the access radius of compromised accounts are critical for helping assess the extent of the breach and taking appropriate action to contain it.
• ‍Identify Additional Sensitive Datastores at Risk – Eureka's data drift and affiliation insights help identify other data stores sharing the same core data or replicated without proper security controls. By flagging related data stores and sensitive repositories lacking security measures, Eureka enables you to proactively address potential vulnerabilities.

‍

4. Mitigation

In the aftermath of a breach, time is of the essence to minimize its repercussions and prevent escalation. Proactive containment can limit further data exposure and enhance your ability to restore normalcy. 

• ‍Isolate/Shut Down Compromised Data Store – Eureka's activity analysis allows you to quickly determine who is accessing the compromised datastore, facilitating prompt isolation or shutdown to contain the breach and prevent further data loss.‍
• Disable Compromised Accounts – Using Eureka's identity-centric insights, you can identify and disable potentially compromised local accounts, minimizing the risk of unauthorized access and further exploitation.

5. Prevention

Let’s make sure this doesn’t happen again! Eureka enables the establishment of robust prevention measures and continuously monitors your data sprawl to fortify your defenses against future incidents.

• ‍Enforce Conditional Access – Establish processes with Eureka and third-party integrations to enforce conditional access for sanctioned data stores holding sensitive information.

Data breaches are undoubtedly stressful, but tackling them doesn’t have to be. What’s required are the right tools to initiate a swift response, thorough assessment, proactive mitigation and prevention measures. We built Eureka’s DSPM platform as a one-stop-shop to do just that with the granularity it takes to truly manage data security posture from end-to-end, and a unified place to see, understand and manage data access and usage, too. With Eureka, enterprises can finally regain total control over the data residing in their cloud while scaling data access and usage with complete confidence.

Through transparent incident response and continuous improvement facilitated by Eureka, you can emerge from a breach stronger, more resilient and better prepared to face future cybersecurity threats.