Criminal hackers breached the United Nations’ computer networks earlier this year, although this incident has only now been reported, and as a result they made off with a trove of data. The concern expressed at the time was how these data could be used to target the various agencies operating within the intergovernmental organization.
According to UN spokesperson Stéphane Dujarric: “We can confirm that unknown attackers were able to breach parts of the United Nations infrastructure in April of 2021… We can also confirm that further attacks have been detected and are being responded to, that are linked to the earlier breach.”
Looking at the issue and its full ramifications is Troy Gill, who is the Senior Manager of Threat Intelligence at Zix | AppRiver. He also sets out the case for improved cyber-awareness in his message to Digital Journal.
Gill ponders as to how the criminal entity managed to break the defenses of the international governmental body. He finds this relatively straightforward: “It’s likely that hackers got into UN systems easily enough – by just logging in.”
It would appear that the hackers may not have used a sophisticated algorithm to crack the United Nations codes but instead obtained the necessary security details from other actors within the unknow regions of the Internet.
Gill explains: “Stolen credentials are sold on the Dark Web all the time, and cybercriminals jump at the chance to strike any vulnerable organization, let alone one with a global reach.”
To address such a flaw, which may have arisen from an employee inadvertently sharing their security clearance with another person, training and awareness of the global employees would seem to be urgently needed.
With this Gill makes the following recommendation: “Although the United Nations is a large organization, it could still benefit from educating their employees on the same security practices used by smaller firms to protect their passwords and personal information.”
The realities of current security technologies means that organizations must consider the day-to-day weaknesses that exist across information technology. Gill concludes by sating: “Credential stuffing and password spraying techniques will continue to be inevitable, which is why employees must take simple precautions such as using password management or utilizing multi-factor authentication across their devices to protect their data.”
Multi-factor authentication is an electronic authentication method where a computer user is granted access to a website or application once they have successfully presented two or more pieces of evidence (what are termed factors) to an authentication mechanism.
This can include knowledge (that is something only the user knows), possession (as with something only the user has), and inherence (as example, something only the user is). This approach is seen as stronger in protecting valuable data from being accessed by a rogue actor.
