What do a Finnish HVAC company and an American car dealership have in common? Both have been doing a poor job running their computer systems and, as a result, both experienced embarrassing threat management blunders.
Valtia is the property manager of two apartment buildings in the city of Lappeenranta in eastern Finland. Meanwhile, the car dealer systems in question were part of the DealerBuilt customer relationship management (CRM) network, which is used by hundreds of dealers around the country. Both organizations made a combination of four rookie mistakes regarding threat management.
Feeling the Heat
Let’s start with the Finnish apartment buildings. Valtia had its central heating systems connected to the internet for both buildings, and neither of them had any firewalls to protect the network. This actually represents two different mistakes, because the firm also was using public IP addresses that were easily enumerated. That made it a lot easier for cybercriminals to take control of these systems.
Fraudsters were able to inject malware that caused a distributed denial-of-service (DDoS) attack that essentially tied up the control systems, which then caused the heating elements to cease functioning. Finland can have some cold winters, so this could have been a catastrophe. Fortunately, it wasn’t that cold at the time of the attack. It did take weeks, however, to find the root cause and remove the infection, install a firewall and bring the HVAC systems back online.
The next mistake Valtia made was failing to train its maintenance personnel to recognize the cause of the problems in the control system. Because staff had little or no training related to network-based attacks, they didn’t understand what was happening, according to a Finnish news service.
The article also explained that “many housing companies or private owners do not want to invest in network firewalls, and that security in general tends to be lax.” That type of thinking could prove to be disastrous.
Dealer Disaster
The car dealerships that were running their CRM systems had a different problem. According to MacKeeper, cybercriminals breached the CRM database and posted millions of records belonging to both customers and dealer personnel online. These records were encrypted, but the backup files were not. This is the information the malicious actors ultimately published.
Small business owners need to take these simple threat management techniques to heart. A lack of attention to information security, as well as practices such as the use of public IP addresses and unencrypted backups, enabled cybercriminals to compromise critical systems. IT managers should implement basic protective policies, and operational procedures should to build a solid IT security infrastructure.
Learning From Threat Management Missteps
These two incidents point to easily fixable threat management mistakes. As a result of weak security, several apartment buildings went without heat and millions of customers and employees of car dealerships had their data stolen. But both consequences are preventable, especially with the benefit of hindsight.
Download the free IBM E-Book: Integrated Threat Management for Dummies