Protecting Your Digital Assets: Trust, Access, and Control

In 2020, Stradis Healthcare was supplying medical packaging at a time when getting personal protective equipment where it needed to go was critical. Then its shipping operations were disrupted.

The problem wasn't ransomware or a sophisticated attack from overseas. It came from access created by someone the company had legitimately trusted.

Christopher Dobbins, Stradis' former vice president of finance, had administrator access to systems containing the company's shipping information. Before his employment ended, he created an unauthorized user account. When he was terminated, his known access was removed. The account he had already created remained.

Weeks later, Dobbins used that account to regain access, created another unauthorized account, altered more than 115,000 records, and deleted more than 2,300. The disruption delayed PPE shipments by 24 to 72 hours.

Dobbins eventually pleaded guilty, was sentenced to federal prison, and was ordered to pay $221,200 in restitution. But restitution doesn't describe the entire business impact. Stradis dealt with operational disruption, delayed customer shipments during an extraordinary period of demand, investigation and recovery, and what its CEO publicly described as “immeasurable internal harm.” The broader revenue and reputational consequences were never publicly quantified.

Most importantly, Stradis discovered the intrusion when it began having trouble printing shipping labels.

The unauthorized access was discovered after it was used—not when it was created.

That leads to a question worth asking about your own business:

If someone created another way into the systems your business depends on, would you know?

Trust and Access Are Not the Same as Control

Every business has people it needs to trust. Employees, administrators, contractors, software providers, and technology partners need access to systems and information to do their jobs.

Some have considerably more authority than others. They may be able to create accounts, assign privileges, change authentication methods, configure systems, or modify security controls.

That authority isn't inherently a problem. The problem is having significant changes occur without enough visibility to determine whether they are legitimate.

An administrator may create an account for a valid business reason. An employee with privileged access could create one for an unauthorized purpose. An attacker who compromises a privileged identity might do exactly the same thing to establish another way back into the environment.

The event may look similar. The context determines what it means.

NIST's Cybersecurity Framework incorporates least privilege and calls for access privileges to be reviewed as roles and relationships change. The FBI's CJIS Security Policy similarly requires auditing the use of privileged functions because those privileges can be misused by authorized users or by outsiders who compromise their accounts.

The business principle is simpler: if someone can make a significant change to a digital asset your business depends on, you should have a practical way to know it happened.

Visibility Has to Be Useful

Most midsize companies already have systems capable of producing much of this information. Identity platforms, operating systems, applications, firewalls, endpoint security tools, and cloud services generate evidence about what is happening.

The challenge is turning that evidence into useful visibility.

A new account by itself may mean very little. A new privileged account followed by an authentication change, unusual login, or modification to a security control tells a different story. Context turns individual events into information the business can use.

This is where CustosIQ starts with the risk rather than the product. We identify which digital assets matter to the business, who and what can affect them, which changes are significant enough to require visibility, and whether the existing security architecture provides enough information to recognize and investigate them.

Sometimes those capabilities already exist but aren't being used effectively. Sometimes additional monitoring or stronger access controls are appropriate. Higher-risk environments may justify dedicated privileged-access technology or independent testing.

The answer should depend on the risk—not on which security product someone wants to sell.

Would You Know?

The Stradis incident involved a malicious insider, but the underlying problem is broader. An employee gives notice. An MSP is being replaced. A contractor's engagement ends. Responsibilities change. A company is acquired. An administrator's credentials are compromised.

Each can change the risk surrounding privileged access.

Security needs to change with the business. That may mean reducing unnecessary privileges, increasing visibility during a transition, reviewing significant administrative activity, removing known access, and then validating that the expected access is actually gone.

The objective isn't to distrust everyone with administrative authority. Businesses cannot operate that way. The objective is to avoid making trust the only control protecting critical digital assets.

For management, the question is straightforward:

If someone created another way into the systems your business depends on, would you know—and could you determine whether it was legitimate?

If the answer isn't clear, that's worth examining.

CustosIQ helps organizations identify the digital assets that matter, understand who and what can affect them, and determine whether existing controls provide the visibility necessary to recognize and respond to meaningful changes.

Cybersecurity is a business problem.

Not sure what your organization would see? Schedule a Strategy Session with CustosIQ and let's find out.

Talk to CustosIQ