December 9, 2016 By David Strom 2 min read

What do a Finnish HVAC company and an American car dealership have in common? Both have been doing a poor job running their computer systems and, as a result, both experienced embarrassing threat management blunders.

Valtia is the property manager of two apartment buildings in the city of Lappeenranta in eastern Finland. Meanwhile, the car dealer systems in question were part of the DealerBuilt customer relationship management (CRM) network, which is used by hundreds of dealers around the country. Both organizations made a combination of four rookie mistakes regarding threat management.

Feeling the Heat

Let’s start with the Finnish apartment buildings. Valtia had its central heating systems connected to the internet for both buildings, and neither of them had any firewalls to protect the network. This actually represents two different mistakes, because the firm also was using public IP addresses that were easily enumerated. That made it a lot easier for cybercriminals to take control of these systems.

Fraudsters were able to inject malware that caused a distributed denial-of-service (DDoS) attack that essentially tied up the control systems, which then caused the heating elements to cease functioning. Finland can have some cold winters, so this could have been a catastrophe. Fortunately, it wasn’t that cold at the time of the attack. It did take weeks, however, to find the root cause and remove the infection, install a firewall and bring the HVAC systems back online.

The next mistake Valtia made was failing to train its maintenance personnel to recognize the cause of the problems in the control system. Because staff had little or no training related to network-based attacks, they didn’t understand what was happening, according to a Finnish news service.

The article also explained that “many housing companies or private owners do not want to invest in network firewalls, and that security in general tends to be lax.” That type of thinking could prove to be disastrous.

Dealer Disaster

The car dealerships that were running their CRM systems had a different problem. According to MacKeeper, cybercriminals breached the CRM database and posted millions of records belonging to both customers and dealer personnel online. These records were encrypted, but the backup files were not. This is the information the malicious actors ultimately published.

Small business owners need to take these simple threat management techniques to heart. A lack of attention to information security, as well as practices such as the use of public IP addresses and unencrypted backups, enabled cybercriminals to compromise critical systems. IT managers should implement basic protective policies, and operational procedures should to build a solid IT security infrastructure.

Learning From Threat Management Missteps

These two incidents point to easily fixable threat management mistakes. As a result of weak security, several apartment buildings went without heat and millions of customers and employees of car dealerships had their data stolen. But both consequences are preventable, especially with the benefit of hindsight.

Download the free IBM E-Book: Integrated Threat Management for Dummies

More from Network

New cybersecurity sheets from CISA and NSA: An overview

4 min read - The Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA) have recently released new CSI (Cybersecurity Information) sheets aimed at providing information and guidelines to organizations on how to effectively secure their cloud environments.This new release includes a total of five CSI sheets, covering various aspects of cloud security such as threat mitigation, identity and access management, network security and more. Here's our overview of the new CSI sheets, what they address and the key takeaways from each.Implementing…

Databases beware: Abusing Microsoft SQL Server with SQLRecon

20 min read - Over the course of my career, I’ve had the privileged opportunity to peek behind the veil of some of the largest organizations in the world. In my experience, most industry verticals rely on enterprise Windows networks. In fact, I can count on one hand the number of times I have seen a decentralized zero-trust network, enterprise Linux, macOS network, or Active Directory alternative (FreeIPA). As I navigate my way through these large and often complex enterprise networks, it is common…

Easy configuration fixes can protect your server from attack

4 min read - In March 2023, data on more than 56,000 people — including Social Security numbers and other personal information — was stolen in the D.C. Health Benefit Exchange Authority breach. The online health insurance marketplace hack exposed the personal details of Congress members, their families, staff and tens of thousands of other Washington-area residents. It appears the D.C. breach was due to “human error”, according to a recent report. Apparently, a computer server was misconfigured to allow access to data without proper…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today