It is a warm evening at the headquarters of a multinational corporation. Everyone is busy with their work. Suddenly, there was an outage. The IT and security teams made minor adjustments to the configurations for the resumption of systems from the outage.

In urgency, they forgot to document the changes they made to servers and systems. There are many such instances where the security or IT teams must make administrative changes.

After some time, the organization becomes a victim of a massive cyber-attack. Upon investigation, the organization’s security team found that the hacker had exploited many hidden vulnerabilities that arose out of misconfigurations in their security. What happened? How and why did it happen? Let us find out!

What is security drift?

Security drift is a phenomenon that occurs when status quo configurations drift away from the baseline or standards. These configuration gaps often go unnoticed, developing gradually over time because configurations are constantly subject to change.

It could be due to any reason, whether it is an update/patch or any immediate human intervention (any quick changes in configuration due to outage, like the example in the beginning).

It is a hidden threat that becomes a silent killer. Unlike any sudden cyber attack, security drift often builds up over time, causing serious problems for an organization.

How does security drift occur?

A security drift can occur when an organization is subject to growth in size when there are more interconnected and sophisticated systems. It could happen due to human error. Even a misconfiguration that technically does not violate any standards (NIST, ISO27001, CIS, etc.) can create security drift.

The following are some of the common scenarios where security drift occurs:

Any changes made by administrative users: It includes any ad hoc configurations or troubleshooting done by security teams on networks, operating systems, or applications while addressing urgent issues (like responding to an outage).

Any upgrade in size, software, systems, or hardware: Changes in architecture (moving from on-premises to cloud or adding more servers), hardware or software upgrades, or adding third-party services that make changes to API can cause changes to configurations without human intervention.

Any undocumented/ uncommunicated changes: When IT or security teams make any urgent changes without communicating/documenting it or when admin users don’t follow the authorization procedures while troubleshooting, it can cause security drift.

Any unauthorized activity: It includes any changes made to the system due to unauthorized action like a user downloading an unauthorized application.

Any gap in communication: It occurs when the rest of the team members are unaware of changes made by the IT or security team or the status quo state of configurations.

Any gaps unidentified in periodic audits: Many organizations rely solely on audits for security.  The audits might occur annually, missing the gaps in configurations that accumulate over time causing security drift.

Real world examples of security drift

Web server

Configurations on web servers can drift away from the intended standards due to several reasons.  For example, switching off HTTP Strict Transport Security (HSTS) or making alterations in   TLS Settings in Azure. These misconfigurations can be exploited to orchestrate Man in the Middle attacks.

Firewall

When a user makes any changes to the firewall configuration, it can accumulate weaknesses. For example, when a developer temporarily opens SSH (port 22) or RDP (port 3389), it can increase exposure to threats since attackers often target RDP and SSH ports.

Cloud

Any changes to cloud configurations that go unnoticed can create weaknesses in the cloud environment. These security weaknesses (like vulnerabilities in Identity Access Management) can be exploited by attackers to gain access to unencrypted storage. For example, leaving the Amazon AWS S3 bucket open to the public can allow unauthorized access to sensitive information over the cloud.

What are the risks associated with security drift?

The following are some of the hidden risks associated with security drift:

Creates hidden and exploitable security vulnerabilities

Any changes in configurations, either unintentional or through human intervention, can cause hidden security weaknesses to accumulate in systems. These misconfigurations can be exploited by attackers to gain access to the network and steal information. For example, a cybercriminal can exploit an outdated firewall rule to gain access to a network or gain access to sensitive assets by exploiting a misconfigured identity access policy.

Increases the risks of data breaches

Any unknown change in configuration can be exploited by an attacker to carry out a full-blown cyber attack. The attacker can gain access to a network and data, engage in surveillance, and cause disruption in operations. For example, DDoS attacks occur with cyber criminals exploiting misconfigured firewalls, web servers, and networks.    

Causes downtime

Cybercriminals can exploit weaknesses and misconfigurations to orchestrate disruptive DDoS attacks that can cause downtime, severely impacting operations revenue and reputation.

Causes performance issues/Operational inefficiencies

Any form of unknown/undocumented changes in the configuration can cause operational and performance issues. It can result in IT and security teams spending more time troubleshooting unexpected emergent problems and losing focus on critical security problems and improvements. It can have a negative impact on the performance of systems and applications.

Renders security controls ineffective

Any drift in security configurations can cause performance issues in security controls(they might stop working as they should). It can weaken security policies and disable aspects of security, creating unnoticed gaps in defense exploitable by hackers to orchestrate a massive and persistent cyber attack.

Increases the risk of non-compliance

Since cybersecurity regulations like HIPAA, GDPR, and PCI-DSS and standards like ISO27001 strictly require organizations to adhere to security configurations as per the requirements and standards, any form of deviation can result in hefty fines.

Invites unwanted costs

A security drift can cause huge financial losses, whether they are the costs incurred due to operational inefficiency, damages from a cyber attack, or hefty fines paid because of non-compliance.  It can result in damage to years of reputation due to data breaches and non-compliance.  

How to prevent security drift and the risks associated?

The following are some effective ways to manage security risks:

Continuous monitoring of security controls and configurations

Periodic compliance audits are not enough to ensure complete resilience against cyber threats. They can miss the hidden security weaknesses that accumulate over time due to changes in configurations. Therefore, it is critical to continuously monitor the security configurations & controls on a real-time basis for changes, including all the aspects of infrastructure like firewall, endpoints, servers, cloud, etc. as well as newly added devices to the network and ad hoc changes made to systems and applications. It prepares organizations for early detection of data breaches and prevents potential threats to your organizations.

Automating configuration assessments

Human error (failing to document any configuration change) can create unintended misconfigurations that can create graver challenges in security in the long run. It is where automating the process of identifying and addressing configuration gaps comes into the picture. Automating the process using dedicated configuration management tools that scan network devices and applications for configuration changes can help significantly reduce the risk of security drift.

Setting benchmarks and baselines

Creating and setting benchmarks and baselines not only saves time in keeping track of configurations but it also saves organizations from unwanted loss of time due to confusions between security and IT teams and other team members. With benchmarks and baselines, security teams can quickly detect whether a security drift has occurred and can restore the system to the original state as per the standards. Organizations can create benchmarks and baselines from standards like NIST and CIS guidelines that provide effective starting points.

Standardization of change management processes

One of the major factors for security drift is human error, whether it is failing to document configuration changes or not following any proper channel of approval while making configuration changes. Therefore, establishing a systematic process for change management that requires approval and documentation at every configuration change is essential to minimize the possibility of security drift.

Take the assistance of experts in proactively addressing security drift

Taking the assistance of experts can help organizations get the much-needed expertise to set benchmarks and baselines for configurations, automate configuration management process and establish a standardized process for change management.

To summarize it

We have explored what risk tolerance and risk appetite are and how important they are together in helping businesses align cybersecurity with their business goals. It can help CISOs, and C-suite make informed investment decisions for cybersecurity.