Lax Controls Leave Fortune 500 Overexposed On the Net

Large companies are leaving easy-to-exploit systems exposed on the public Internet, raising the risk of a serious future compromise, according to data from two cybersecurity firms. 

Rapid7 found that the average Fortune 500 firm had approximately 500 servers and devices connected to the Internet, with five- to 10 systems exposing Windows file-sharing or Telnet services. Fifteen out of the 21 industry sectors on which Rapid7 collected data had at lease one member allowing public access to a Windows file-sharing service.

This simple-to-spot oversights suggest that companies do not have adequate control over what systems are connected to the public network, says Tod (CQ) Beardsley, research director of Rapid7, which published a report last week on its findings.

"I would advise everyone, from the Fortune 500 on down, to be aware of what you are exposing to the Internet," Beardsley says. "Any chance you have of taking something off the Internet—every device you take of the Internet is one less device for attackers to compromise." 

The report refutes the common wisdom that larger companies, with their greater resources and more skilled security teams, are better defended against cyberattacks than smaller firms. While it's easy to assume that larger firms generally have more resources to allocate to cybersecurity, they also have many more devices connected to the Net, a sprawling infrastructure. and a greater attack surface area. 

Both Rapid7's report and an earlier report by security ratings company BitSight found that larger firms were likely to have self-inflicted holes in their defenses. 

"Bigger doesn't always mean better," says Jake Olcott, vice president of government affairs for BitSight. "Just because you are a large organization with lots of resources doesn't necessary mean that your security performance is better. In general, the larger the organization, the larger the attack surface."

The reports show that companies need to focus on three main areas to button up their systems and eliminate the security issues for which attackers are constantly on the lookout.

Know Your Assets

Rapid7 had little trouble identifying the various systems and devices connected to the Internet. On average, Fortune 500 companies had 500 systems connected to the public network: overall, large companies should consider that the baseline for the number of systems that should be exposed to the network. A significant fraction of technology, business-service and financial firms had thousands of exposed servers, Rapid7 found.

"When you are that far off of the norm, that tells me you have an asset management problem," Beardsley says. "It tells me that those companies are just littered with vulnerable systems connected to the Internet." 

At least one company in each of the aerospace & defense, chemical, and retail industries had more than 20,000 systems accessible through the Internet, Rapid7 found.

Getting those assets under control is important. While many applications may warrant being connected to the Internet, the companies with greater than 1,000 connected systems are offering attackers a very enticing attack surface area.

Watch Outbound Traffic 

Both Rapid7 and BitSight regularly see traffic generated by compromised systems coming from Internet addresses assigned to large companies. Rapid7, for example, found that the healthcare, retail, and technology sectors all had a high incidence of malicious traffic coming from their networks.

In its 2017 report, How Secure Are America’s Largest Business Partners?, BitSight found that 15% of companies produced traffic suggesting a compromise by Conficker, malware that is almost a decade old. Other infections included Necurs, Bedep, and Zeus. "Many organizations are not aware of these issues inside their networks," BitSight's Olcott says. "The traffic is absolutely an indicator that there is something bad happening."

It's not clear from the traffic data whether companies are having trouble eradicating malware or if they just don't know about a system harboring malicious code, he says.

"It could be a governance issue or a technology issue, or it might be an employee-training and awareness issue," Olcott says. "The root cause — the challenge that these organizations have is it is very hard for them to get visibility into their environments."

Eliminate Easy-to-Exploit Services

For modern companies, there is no reason to expose either Windows file-sharing, Telnet, or file-transfer protocol (FTP) services to the public network. Yet, at least a third of companies are hosting serveers with one of those services available, according to BitSight data.

Exposing Windows file-sharing through the SMB protocol opens up companies to debilitating attacks such as WannaCry, NotPetya, and other ransomware. Companies in at least 15 of the 21 sectors monitored by Rapid7 have servers with Windows file-sharing available through the public network. And more than 48 companies of the Fortune 500 have Telnet exposed on the Net, the company says. 

"If you can get rid of all of the Internet-facing Telnet and SMB, you are miles ahead of the rest of the Internet, and you will avoid contributing to the next WannaCry," Rapid7's Beardsley says.

Related Content: