{"id":5586,"date":"2023-07-27T11:18:48","date_gmt":"2023-07-27T15:18:48","guid":{"rendered":"https:\/\/solutionsreview.com\/network-monitoring\/?p=5586"},"modified":"2023-07-28T16:34:57","modified_gmt":"2023-07-28T20:34:57","slug":"the-moveit-effect-protecting-public-facing-applications","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/network-monitoring\/the-moveit-effect-protecting-public-facing-applications\/","title":{"rendered":"The MOVEit Effect: Protecting Public-Facing Applications"},"content":{"rendered":"

\"MOVEit\"<\/p>\n

Solutions Review\u2019s\u00a0<\/strong><\/i>Contributed Content Series<\/u><\/strong><\/i><\/a>\u00a0is a collection of contributed articles written by thought leaders in enterprise software categories.\u00a0<\/strong><\/i>Kiran Chinnagangannagari of Securin<\/a> looks at the impact of the MOVEit exploit for answers in protecting public-facing applications.<\/strong><\/em><\/p>\n

Organizations globally use public-facing applications every day to keep their businesses running. Servers, virtual private networks (VPNs), and application programming interfaces (APIs) are all common forms of third-party, public-facing applications that make accessing a service or completing work more efficient — but less secure. Many of these web-based applications can be used as a point of entry by bad actors to exploit vulnerabilities, gain access to proprietary information, and hold systems for ransom. Organizations involving strict compliance laws – like healthcare or finance – can be at elevated risk of damages from a data breach.<\/p>\n

This is precisely what happened to MOVEit Transfer, which was exploited by the Cl0p ransomware group. The managed file transfer (MFT) solution is used to transfer files between customers and businesses safely and securely \u2013 and was discovered to have 2,500 exposed servers, most of which were in the U.S. This breach most recently attacked the government of Nova Scotia, Aer Lingus airlines, and the BBC among many others. These vulnerabilities allowed attackers to intercept, control, and exploit shared files, resulting in data breaches and potential financial, reputational, and legal consequences.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

The MOVEit Effect: Protecting Public-Facing Applications<\/strong><\/h2>\n
\n

The Clop Ransomware Gang<\/strong><\/h3>\n

Public-facing applications such as MOVEit have a wide attack surface because of the need for third parties to function and make accessing their platforms easier for users. Services providing APIs, VPNs, and more pose a risk to organizations because they offer an additional point of entry to bad actors. In the case of MOVEit, vendors and customers all had third-party access to the transfer system. These access points were potentially being used by Cl0p to penetrate the system, gain access to proprietary information, and encrypt files in its wake.<\/p>\n

The MOVEit attack demonstrated the strength and intelligence of the Cl0p ransomware gang, which has worked to breach and attack many organizations since 2019. Cl0p uses tactics to avoid detection, making it harder for victims to notice attacks when they occur and easier for the ransomware to kill backup and security processes before encrypting files.<\/p>\n

Cl0p injects ransomware into network systems and is then granted false certification that allows the virus to manipulate system data and catalog technical details to share with threat actors. Targeting systems by encrypting .jpg, .mp3, and .doc files and installing a Cl0p extension renders files inaccessible to victims. The gang then requires a ransom payment to remove the ransomware and allow victims to recover their data.<\/p>\n

The Cl0p ransomware gang continues to threaten organizations in various sectors and poses several risks for those affected. Cl0p has exploited many vulnerabilities, including the SolarWinds Serv-U FTP vulnerability and the GoAnywhere MFT zero-day vulnerability. Recently, Cl0p has targeted public-facing applications. The MOVEit attack was performed by finding an entry point in the platform, resulting in potential access to files containing intellectual property (IP) or personally identifiable information (PII). Taking proactive steps to protect your data by backing up and updating systems, protecting networks, and using security barriers like multi-factor authentication to secure your files and prevent a hostile breach is important.<\/p>\n

Organization Security Strategies and Best Practices<\/strong><\/h3>\n

In today’s digital landscape, where sensitive public-facing applications like MOVEit play a crucial role in facilitating secure data transfers, adopting a proactive and holistic security strategy is imperative. The attack surface for such applications is extensive, encompassing various potential entry points for cyber threats. Therefore, it is essential to go beyond reactive security measures and implement a proactive approach that continuously monitors and addresses potential risks.<\/p>\n

Here are some places to start:<\/p>\n