Unauthorized access (UA)

What is unauthorized access

Unauthorized access (UA) is access to information, resources or systems carried out in violation of the established access control rules. UA can be carried out both with the use of standard computing tools (for example, password guessing, use of a forgotten session) and with the use of special tools to overcome protection systems (hacking, exploitation of vulnerabilities, social engineering). UA is one of the main threats to information security and an object of protection for cryptographic protection tools (CIPF), firewalls and access control systems. The prevention of UA is regulated by legislation, including 152-FZ "On Personal Data" and 187-FZ on CII security. Every year, the damage from UA in the world amounts to trillions of dollars, and the number of successful attacks continues to grow, which makes protection from UA one of the priority directions for any organization.

Main types of UA

Unauthorized access is classified by the method of implementation and the type of threat. Direct access is physical access to equipment (servers, workstations, network switches) in order to steal, modify or destroy data, install hardware bookmarks or connect to control interfaces. Network access is penetration into a system through network interfaces (exploitation of vulnerabilities in web applications, password guessing, man-in-the-middle (MITM) attacks, DNS substitution, SQL injections, cross-site scripting). Insider access is the use of legitimate employee accounts for unauthorized actions (abuse of authority, work after dismissal, use of privileged access to steal data). Access through social engineering is obtaining credentials by deceiving users (phishing, vishing, smishing). Access through removable media is also distinguished — the use of infected USB flash drives, CD/DVD discs or external hard drives to inject malware. To prevent UA, identification and authentication systems, multi-factor authentication (MFA), DLP systems and access control tools such as ACS are used.

Protection from UA

Comprehensive protection from unauthorized access includes several levels that must be implemented to ensure reliable security. Organizational measures — development and implementation of security policies, access regulations, instructions for employees, regular training of staff on information security rules. Software and hardware tools — installation and configuration of CIPF, firewalls (Firewall, NGFW), intrusion detection and prevention systems (IDS/IPS), antivirus software, data cryptographic protection tools. Monitoring and audit — registration of all access attempts to information systems, log analysis using SIEM systems, regular audit of security journals. Physical protection — restriction of physical access to server rooms, use of video surveillance and access control systems. Backup — creation and storage of backup copies of critical data for recovery after an attack.

Typical UA channels and attack methods

Attackers use various channels for unauthorized access. Network services — unpatched vulnerabilities in web applications (OWASP Top 10), mail servers, DBMS, content management systems. Control interfaces — weak passwords on administrative panels, SSH, RDP, Telnet, use of standard or easily guessed credentials. Removable media — infected USB flash drives with malware (BadUSB), discs with autostart. Social networks and messengers — phishing links, malicious attachments in letters, fake login pages. Zero-day (0-day) vulnerabilities — previously unknown vulnerabilities for which there are no patches yet. DDoS attacks — used as a distraction for conducting other attacks. To monitor and analyze such threats, SIEM systems, information security monitoring centers (SOC) and NDR systems for network traffic analysis are used.

Information protection tools (PT) against UA

PT against UA are specialized software, hardware or software-hardware tools designed to prevent unauthorized access. In Russia, such tools must be certified by FSTEC of Russia or the FSB of Russia for use in state information systems. PT against UA include: access control systems (mandatory and discretionary management), antivirus protection systems, firewalls (including NGFW of the next generation), intrusion detection systems (IDS/IPS), cryptographic protection systems, data leak protection tools (DLP), identity and access management systems (IAM). The choice of specific tools depends on the class of the protected system, the level of data confidentiality and regulatory requirements. For CII facilities, the use of certified PT from the register of domestic software is required.

Response to UA incidents

When UA is detected, the organization must have an incident response plan (IRP). The response process includes several stages: detection and confirmation of the incident (through SIEM, IDS, user complaints), isolation of the infected network segment and blocking of compromised accounts, collection and preservation of evidence for investigation (logs, memory dumps, network captures), analysis of the incident to determine the attack vector and the scale of damage, elimination of consequences (removal of malware, closing vulnerabilities, changing passwords), restoration of system operability from backup copies, notification of regulators (FSTEC, Roskomnadzor) within the established timeframes, as well as post-incident analysis and updating of security policies. Professional protection system design makes it possible to build an effective multi-level defense.