The Security Interviews: Why you need to protect abandoned digital assets

Abandoned assets

Rather than decommissioning or deleting these regional assets, they have often simply been rendered dormant. The assumption is that, eventually, the situation will cool down and that trading with Russia will become viable again. Therefore, planning to reactivate existing regional assets, rather than creating them afresh, makes economic sense.

However, in the disruption caused by their rapid exit from the country, there is the question of whether companies were able to adequately shut down and secure all their localised digital assets.

The dangers posed by these abandoned assets are multifarious. Local digital assets can be usurped and used for malicious purposes, such as identity theft and credit card fraud. Not only does this leave organisations open to significant fines for breaches of data protection laws, there is the associated reputational harm caused by these incidents.

“The risk depends what the connection is pointing to and what authentication or security measures have been put in place,” says Nahmias. “Security teams tend to be more lenient about connections to internal resources than they are about connections to external ones.”

The distributed nature of modern enterprise means that networks are no longer spiders webs, but a complex mesh. While this is a far more robust form of network connectivity, there are also far more connections that need to be managed. As such, there is a potential risk of network connections from abandoned assets still being active, essentially permitting access to the rest of the corporate network. In many ways, this is a far greater risk to the organisation, as malicious actors could potentially obtain confidential information through these unsecured connections.

“Enterprises operate many domains – in some cases, even millions – so monitoring them manually is simply not an option,” says Nahmias. “There’s a lot of complexity involved – it’s DNS spaghetti. While we believe that most companies attempted to wipe their Russian IT connections clean, in most cases they have failed to do so.”

There is also a danger that abandoned regional assets could be accessed and hacked in anticipation of when they are eventually reactivated. This would essentially act as a backdoor, enabling malicious actors to bypass network security for deploying malicious software within a corporate network. These tactics could be exploited by local criminals, as well as hackers sponsored by nation-states.

“If a US-based consumer global brand exited Russia and closed their Russian site, but hadn’t done it properly, a malicious actor could revive it and potentially abuse innocent customers, harming the reputation of the global brand,” says Nahmias.

What needs to be done?

Organisations need to ensure that all their abandoned local assets have been rendered completely dormant and that they continue to retain rights of ownership for their digital domains.

Likewise, organisations need to review the connections between these abandoned local assets and the wider corporate network to ensure they have been properly tied off, either by removing these connections altogether or by sending the connections to a landing page that leads nowhere. However, the number of connections that are now out there is such that this is no longer manageable by conventional means. 

“If you have a million domains or IDs, or 100,000 PCs, it’s not a human job anymore. AI [artificial intelligence] will have to come in,” says Nahmias. “Someone needs to provide a way of understanding when something breaks. The time to detect and respond is going to be the key to success.”

From a wider perspective, especially for multinational organisations that have a massively distributed network, this situation has demonstrated the need for a single oversight role. Rather than having a series of network managers and their teams, focusing on their specialist areas with limited coordination between them, the events of recent months have highlighted the need for a single oversight role, which can coordinate and control all of the digital infrastructure.

“PKI, cloud, DNS and web are typically managed by different teams that sometimes connect only at the CIO level. That means there are four people in an organisation examining the Russia relationship, and then collaborating the results,” says Nahmias.

Some may wonder that with organisations abandoning regional assets and reducing the number of regions they operate in, if centralised network models will become predominant again. While this would minimise the threat surface, it would not negate the risk completely and organisations would be unable to reap the benefits of a robust distributed hybrid network. Therefore, instead of minimising the attack surface, organisations will need to focus on securing connections.

“I don’t think that closing it down is the way to address the issue,” says Nahmias. “You might have a smaller attack surface, but it’s still there. You might as well look at preventing the malicious actors from abusing the attack surface, small or large.”

Conclusion

Rather than destroying their assets when boycotting Russia and Belarus, organisations have taken the long view and have instead decommissioned them. When the situation has deescalated, if organisations are willing to resume trading, they will want to reactivate their previously abandoned assets to enable a swift return to the market.

“The relationship between DNS and security is something that we see evolving in a lot of areas of companies today,” says Nahmias. “I would like to believe that most companies have done some sort of best effort, but I don’t think that they’ll all necessarily able to devote all their attention to the potential risks. Some of the risk is immediate and present, but there is another big piece that is a Pandora’s box in Russia, that one day will open.”

A suitable review of an organisation’s abandoned domains will highlight any potential vulnerability in their network’s security posture. For example, this could be an automated process that flags any discrepancies, together with their associated network connections, for human review. The situation has also highlighted the need for a network oversight role, rather than relying on the collaboration between series of specialist network teams, to ensure that the overarching corporate goals are being met.

“Security will have to be identifying the anomalies in a much broader spectrum,” concludes Nahmias. “Security will have to evolve to accept some risk and identify breaches when they happen to minimise the effect.”