Jason: Unauthorized change or hardware. 2 2
In this lesson, we are going to talk 3 3
about unauthorized changes or unauthorized hardware, 4 4
because both of these can be an indicator of compromise. 5 5
Now, when you're dealing with an unauthorized change, 6 6
this is any change that's been made 7 7
to a configuration file, software profile, 8 8
or even hardware without proper authorization 9 9
or undergoing the change management process. 10 10
For example, when I talked about software being installed 11 11
by some user without permission, 12 12
that is technically an unauthorized change. 13 13
Unauthorized changes can occur to software, 14 14
or they can occur to hardware. 15 15
Both of these are considered unauthorized changes. 16 16
Now, let's take a really common example 17 17
that I see all the time. 18 18
Somebody takes a USB thumb drive, 19 19
they plug it into their laptop. 20 20
That is an unauthorized change 21 21
if it goes against your current policy. 22 22
For example, the last couple of organizations I worked at, 23 23
we did not allow USB thumb drives to be used, 24 24
because they are a huge infection vector 25 25
that can bring a lot of malware into your systems. 26 26
So if we saw somebody do that, 27 27
that was something that would actually flag an alert 28 28
on the system, it would reject that information 29 29
from getting onto the system because of that, 30 30
and we would actually send out security 31 31
to go look at that machine 32 32
and make sure nothing got onto it. 33 33
The reason for this is because USB firmware 34 34
can actually be reprogrammed to make that device 35 35
look like it's another device class. 36 36
So for example, we block mass storage devices 37 37
with the use of USBs. 38 38
So if you plug in a USB thumb drive, 39 39
it will not read from it, 40 40
because it realizes this is a USB thumb drive. 41 41
But if you've changed the firmware on it, 42 42
you can actually make that USB drive 43 43
to report as a keyboard or a human interface device. 44 44
And so when you plug it in, 45 45
it can actually start sending keystrokes 46 46
to the operating system. 47 47
This can actually be another infection vector 48 48
that malware can use, 49 49
because instead of being able to copy a file over, 50 50
it can send in those unauthorized keystrokes. 51 51
For this reason, I recommend 52 52
that you do not allow USB devices inside your organization, 53 53
especially USB thumb drives. 54 54
Most high security environments 55 55
will ban this type of device 56 56
and not allow them in the building. 57 57
Now, you may be saying, Jason, that's great. 58 58
You can go ahead and ban devices, 59 59
but people are still going to need them for certain use cases. 60 60
So what do you do then? 61 61
Well, in those cases, you want have a process in place 62 62
where you can scan them 63 63
and verify that they're clean first. 64 64
The way I like to do this 65 65
is to connect that suspect hardware device 66 66
to a sandbox and analyze it first. 67 67
This way we can prevent the number of people 68 68
who are bringing USB devices into the building, 69 69
and any that are brought in, we can check 70 70
and make sure there's nothing malicious on them. 71 71
This gives us a chance to actually analyze it 72 72
and look at it, and by using a sandbox, 73 73
if it is something that was bad, 74 74
it's not going to get into the rest of the network, 75 75
because it's isolated in that sandbox. 76 76
But again, the best policy here 77 77
is to not allow those USB devices, 78 78
'cause they are a huge infection vector, 79 79
and something you should really be on the lookout for.