So if you haven't heard, last week it was reported that a disgruntled employee that resigned after a dispute with management from the U.S. subsidiary of Japanese drug-maker Shionogi decided to get retribution by logging into the company's critical virtualization infrastructure and wiping out 15 virtual hosts that were running e-mail, order tracking, financial and other services. According to court filings by the U.S. Department of Justice, this attack effectively froze Shionogi's operations for a number of days, leaving company employees unable to ship product, to cut checks, or even to communicate via e-mail. The cost to Shionogi was well over $800,000 US, including over $300,000 in costs to restore operations and respond to the attack.
What is interesting about this incident was that the ex-employee was hired back as a consultant with full credentials for a few more months, and never had that access recinded. The result was that he was able to log in from a McDonalds many months later into a management console he had secretly installed and do his damage. The only reason he got caught was he used his own credit card at the McDonalds just minutes before the attack, and logged in as administrator well after he was let go from the company using his home PCs. Hope that burger was worth it.
Investigators were lucky to be able to bind his credit card transaction to the incident. Had that not occurred, it would have been extremely more difficult to identify the culprit. Of course, had AuthAnvil been used to protect the administrative credentials, they could have simultaniously revoke his access to all systems by disabling his token when his contract was terminated. Or at the very least have evidence of the login when it occured by binding his own OTP to the shared administrative credentials being used. Goes to show just how easy this sort of thing can happen, and how it can happen so quickly.
Simply put, if you are using a virtualization enivronment like VMWare or HyperV, you own it to yourself to ensure the infrastructure is well protected. You should be enforcing strong authentication to prove the identity of the party accessing the underlying parent server(s), and ensure your HR processes revoke such access to said systems when the ex-employee is no longer with the organization.
Using AuthAnvil to help revoke access when letting an employee go is rather trival. With a single click you can prevent them from accessing systems and services you may or may not have remembered they have access to. If it has an AuthAnvil protection scope, they won't be able to get in.
