![\"The](\"https:\/\/solutionsreview.com\/identity-management\/files\/2019\/09\/swam.jpg\")
<\/p>\n<\/p>\n
The GoDaddy Data Breach shows businesses of all sizes the importance of more powerful authentication<\/a> and secure shell (SSH) key management. We spoke with several cybersecurity experts to learn more about what organizations can learn from this cyber incident.\u00a0<\/span><\/p>\n Web-hosting and domain name registrar GoDaddy discovered a data breach which occurred in October 2019; the company detected the security incident in April. <\/span>BleepingComputer<\/span><\/a> first broke the story.\u00a0<\/span><\/p>\n According to the company, an \u201cunauthorized individual\u201d gained access to users\u2019 login details to connect to SSH. However, GoDaddy said the breach only affected hosting accounts rather than customer accounts. Further, the intruder did not access customer data, and the breach affected less than 30,000 users.<\/span><\/p>\n On the surface, this appears a minor breach in the grand scheme of digital attacks. However, it highlights fundamental truths about cybersecurity and identity management which some enterprises struggle to grasp. First, it shows that regardless of size, your business remains vulnerable to cyberattacks. Second, the GoDaddy Data Breach shows the perils of using inadequate authentication protocols to protect data. Third, the breach serves as an example of how dangerous a lack of security visibility can be to your business\u2019 reputation, both in the short and long term.\u00a0<\/span><\/p>\n Additionally, it provides a lesson in Secure Shell Keys (SSH); SSH protocols are used to log in remotely from one system to another. By providing strong encryptions, it allows for the secure issuing of commands remotely and remote management. The SSH keys allow access to this encrypted connection.\u00a0<\/span><\/p>\n We turned to the cybersecurity experts to learn more.\u00a0<\/span><\/p>\n Chris DeRamus is Vice President of Technology, Cloud Security Practice, at<\/span><\/i> Rapid7<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cUnauthorized access is a popular culprit behind many data breaches, and this isn\u2019t GoDaddy\u2019s first security issue involving compromised accounts. According to a<\/span> Ponemon survey<\/span><\/a>, 59 percent of IT security respondents say customer accounts have been subject to an account takeover. Customers put their trust in companies by allowing them to collect and store their information. To keep that trust, organizations must be proactive in ensuring that their data is protected with adequate security controls and a robust identity management strategy.\u201d<\/span><\/p>\n \u201cTo protect data, organizations must follow the principle of least-privileged access in provisioning identity access management (IAM) permissions, by providing checks to restrict identities from being able to do more than they are supposed to and implement multi-factor authentication (MFA) for all users. By leveraging MFA, an account is<\/span> 99.9% less likely to be compromised<\/span><\/a>. Additionally, organizations must securely manage service accounts and their corresponding keys, and enforce best practices for the use of audit logs and cloud logging roles.\u201d<\/span><\/p>\n Anurag Kahol is CTO of <\/span><\/i>Bitglass<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cThis security incident impacting GoDaddy customers underscores why organizations need to have full visibility and control over their data. While the web hosting giant confirmed that the breach only affected hosting accounts and not customer accounts or the personal information stored within them, hackers can still leverage the database of login credentials and commit account takeover.\u201d\u00a0\u00a0<\/span><\/p>\n \u201cAccording to <\/span>Verizon<\/span><\/a>, 80 percent of hacking-related breaches involve compromised or weak login credentials. 29 percent of all breaches, regardless of attack type, involve the use of stolen credentials. While it\u2019s ill-advised, people commonly reuse passwords across multiple accounts, meaning attackers can potentially gain access to a number of accounts across multiple services that a victim uses to gather more sensitive information and leverage the data for financial fraud or identity theft for years to come.\u201d<\/span><\/p>\n \u201cAdditionally, this incident comes just two years after GoDaddy had its cloud configuration information exposed after an Amazon employee left an AWS S3 bucket open. The very different nature of these two security incidents underscores the importance of the shared responsibility model when it comes to the cloud.\u201d<\/span><\/p>\n \u201cTo prevent similar incidents and thwart unauthorized access to customer information, organizations must leverage multi-faceted solutions that enforce real-time access control, detect misconfigurations, encrypt sensitive data at rest, manage the sharing of data with external parties, and prevent data leakage. Organizations must also authenticate their users to validate who they are, before granting them access to their systems. Fortunately, multi-factor authentication (MFA) and user and entity behavior analytics (UEBA) are tools that can help companies protect their data.\u201d<\/span><\/p>\n James Carder is CSO and Vice President of <\/span><\/i>LogRhythm Labs<\/span><\/i><\/a>.<\/span><\/i><\/p>\n \u201cIt is astonishing that GoDaddy was unable to detect unauthorized access to <\/span>SSH account credentials for about eight months. With this particular incident, there are further unknowns such as whether sensitive files were exfiltrated from the accounts, and exactly how many accounts from GoDaddy\u2019s hosting environment were compromised.\u201d<\/span><\/p>\n \u201cThe GoDaddy data breach showcases how so many large enterprises still lack a comprehensive approach to detecting and combating threats. <\/span>It is easy to assume that GoDaddy, as the world\u2019s largest domain registrar, would have proper security in place to prevent, detect, and respond to these types of threats. GoDaddy should have had stricter SSH security measures in place rather than just a simple username and password.\u201d<\/span><\/p>\n \u201cStrong SSH key management is critical in protecting internet-accessible SSH. In this case, fundamental controls for properly securing and managing SSH should have been implemented. It is important to ensure that SSH keys are associated with an individual user and are continuously rotated. Additionally, the principle of least privilege should be utilized for the account authorized to SSH and an organization should conduct thorough auditing and monitoring of all privileged sessions and key usage.\u201d<\/span><\/p>\n \u201cIf such controls were implemented, then the likelihood that GoDaddy would have suffered a breach, leveraging stolen or acquired username and passwords, would have been minimal. Of course, no incident is 100 percent preventable, yet, this particular breach reflects how GoDaddy overlooked simple security controls and left low hanging fruit for the attacker to exploit.\u201d<\/span><\/p>\n Thanks to our cybersecurity experts for their time and expertise. Learn more about preventing these kinds of attacks in our Identity Management Buyer\u2019s Guide<\/a>.<\/b><\/p>\n
Widget not in any sidebars
\nThe GoDaddy Breach: Expert Commentary<\/b>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/span><\/h2>\n
Chris DeRamus\u00a0<\/b><\/h3>\n
Anurag Kahol<\/b><\/h3>\n
James Carder\u00a0<\/b><\/h3>\n
<\/div><\/p>\n
![\"Download](\"https:\/\/solutionsreview.com\/identity-management\/files\/2020\/01\/PAM_BG_SB_800.gif\" "\\"\\"")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"