Corporate statements suggest a fundamental misunderstanding in PAM practices exists at the company.
LastPass has demonstrated that it has not followed zero trust principles that have been the bedrock of enterprise security for more than two decades.
This is a massive failure to adequately protect its production resources via Privileged Access Management (PAM) strategies. This Tuesday, LastPass customers were shocked again when they learned that h ackers accessed LastPass’ corporate vault through targeting the personal computer of one of four engineers who had access to production systems via passwords and encryption keys stored in a LastPass shared folder. We recently covered how LastPass customers have been repeatedly shocked since the y learned that essential details of their vault were not encrypted in the breach first reported in August 2022. The second attempt targeted one of the four DevOps engineers individually, infecting their home computer with keylogger malware in order to steal their login information and access the cloud storage environment.This week at the b e g i n n i n g of March 2 023, new details emerged about the origin of the significant LastPass Breach that comprised the company's network and enabled attackers to access its production backups and customer data. The intrusion finally allowed the adversary to collect client data and partially encrypted password vault data. Last week, the troubled password management service disclosed how unknown actors used information obtained from an earlier incident that occurred before August 12, 2022, as well as information "available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack" between August and October 2022.
The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date. 🚨Missed Software Update = Huge Data Breach 🚨
0 kommentar(er)
