CISA Red Team finds critical flaws in federal civilian agency

TLDR:

• An assessment by CISA found critical vulnerabilities in the security posture of a federal civilian executive branch organization.
• The assessment revealed gaps in cybersecurity defenses, network segmentation, log collection, and detection capabilities.

CISA Red Team Exercise Finds Critical Vulnerabilities in Federal Civilian Agency

A recent red team exercise conducted by CISA in early 2023 identified significant weaknesses in the security posture of a federal civilian executive branch organization. The assessment, known as SILENTSHIELD, aimed to simulate a long-term state-sponsored attack and revealed various shortcomings in the organization’s defense mechanisms.

The exercise uncovered that the organization lacked proper network segmentation, failed to prevent and identify malicious activity, had insufficient log collection, and employed a ‘known-bad’ detection approach. The assessment highlighted issues related to bureaucratic communication and decentralized teams among network defenders.

The red team gained initial access to the organization’s network enclave by exploiting an unpatched vulnerability in an Oracle Web application. This led to the deployment of a secure Python remote access tool, granting extensive access to sensitive information, such as personally identifiable data and administrative credentials.

Phishing attacks targeting employees allowed the red team to compromise the Windows environment, harvest Active Directory data, and access internal file servers. Leveraging various techniques, including compromised credentials, the team was able to move laterally within the network, compromise a SCCM server, and gain access to high-value assets.

After the assessment, CISA worked with the organization to enhance its security stance, focusing on improving detection capabilities, log collection, forensic analysis, and monitoring and investigation management. The exercise underscored the importance of robust network defenses, proper segmentation, and effective communication among security teams.