Locking The Door After The Burglar Is Already Inside

When a serious cyber vulnerability is being actively exploited, applying the patch is essential. But it may not be the end of the job.

This week’s Black Cat Threat Briefing highlights a pattern small businesses should pay attention to: ransomware groups and access brokers are continuing to focus on internet-facing systems such as remote access tools, VPNs, Citrix environments, business applications and supplier-managed platforms.

If attackers were already scanning for the weakness, the real question is not only:

“Has the door been locked?”

It's:

“Did anyone get in before we locked it?”

That is the difference between patching and incident checking.

This week’s threat briefing highlights ransomware interest in exposed systems such as Citrix, VPNs, remote access tools and business applications. These systems are often managed by IT providers, but they are still business-critical doors into the organisation.

So when an emergency vulnerability affects a product you use, ask your threat intelligence provider:

• When did attackers start to exploit the exposed vulnerability?

You should ask your IT provider:

• Was the affected system exposed to the internet?

• When was it patched or mitigated?

If you were patched before the exploitation or the system was not reachable you can move back from incident response mode.

If not ask your IT provider:

• Follow the Product vendor advice to look for Indicators Of Compromise (IOCs).

• Were logs checked for suspicious access?

• Were any new accounts, configuration changes or remote tools found?

Patching locks the door.

Checking for compromise tells you whether someone is already inside.