On March 10, 2021, Bloomberg released a story claiming an international hacker collective, APT-69420 had broken into a network of 150,000 surveillance cameras. The cameras were installed in various facilities, including prisons, hospitals and warehouses. A Swiss hacker from the collective, Tillie Kottman, claimed to have accessed the cloud-based company Verkada’s live video feeds by hacking a “superuser” account—an account with virtually unlimited privileges and ownership of a system.
“The whole idea of having ‘global admin access’ for your customer support team to access all of your customers’ accounts is insane,” stated Mishit Patel, Head of Technology at Genea. “Let your customer decide who can have access to their system.”
The hack not only jeopardized the security of Verkada’s clients but Verkada itself.
CDW Corp. initially removed Verkada cameras from their e-commerce store. At the time, Conor Healy, government director at IPVM, a video surveillance industry research firm, commented on the incident.
“CDW is one of, if not the largest, Verkada partner and a top means for selling to end-users, so losing CDW would be a material problem for Verkada,” Healy said.
Luckily for Verkada, the removal only lasted a day. But the hack provided a sobering reminder that access control networks are far from ironclad, and a compromised superuser account could cripple a business.
Minimize Access Control Vulnerability: Drink Your POLP
There are ways property teams can reduce the risk of cyberattacks.
The Principle of Least Privilege (POLP) is one example. “POLP” may sound like the floaty stuff found in Florida orange juice. However, not unlike the vitamin-rich drink, POLP is essential for maintaining health…of access control security, that is.
The Principle of Least Privilege is the philosophy of limiting user permissions. Users are only permitted to read, write or execute the files and resources essential to work activities they must perform.
But why is POLP important for a healthy access control system?
In the Off-Ice Building Tower, the freezer manufacturer Polar Penguin employs many different levels of employees. Some employees only need access to the “Igloo”— the main office area. Others need access to file rooms, executive suites, and walk-in-freezers. Under POLP only frequent users of these “high security” areas should be given access credentials. The more employees Polar Penguin distributes these high-level credentials to, the more vulnerable their system becomes. If compromised, superuser accounts, like the one used in the Verkada hack, expose companies to a tremendous security risk.
How to Implement POLP
- Conduct frequent privilege audits. Check all user accounts to ensure they only have the necessary permissions to perform their work.
- Start all accounts with the lowest privileges possible.
- Compartmentalize your privileges. Separate administrative accounts from standard and executive accounts.
- Use one-time credentials. Monitor, automatically audit, and track user actions.
- Use time-restriction features. Cloud-based access control grants the flexibility to control when and where credentials are accepted. Genea’s Safe Workplace features a questionnaire. Developed for COVID-19 purposes, the feature restricts an employee from accessing the office until they complete a health survey. Such technology could be used to limit access or create customizable time-restricted access.
For companies undeterred from using superuser accounts, Patel strongly recommends implementing two-factor authentication (2FA).
“If Verkada’s ‘global admin access’ account had required 2FA, (the system) would have blocked the hacker or made it extremely difficult to access Verkada’s customers’ accounts,” Patel stated.
While Verkada’s CEO Filip Kaliszan confirmed that the company revoked their global admin access to cameras, only time will tell the magnitude of fallout due to the security oversight.
Interested in enhancing the security of your business premise? Schedule a demo today to learn more about Genea’s building access control system.