Security Oversights: The British Museum’s Costly Mistake

A Cyber Attack in January caused wide-spread IT disruption at the British Museum, including gallery and temporary exhibition closures, as well as an inability to deal with ticketing transactions. 

This was met, by me at least, with a weary sigh as it seemed like yet another large institution had been brought to its knees by a cyber-attack.  However, the reality turned out to be something much more mundane – a disgruntled IT Contractor taking revenge after their services were terminated.

Cyber security is, rightly, a hot topic for any organisation. As the number of internet-connected devices and locations has proliferated it creates the potential for all kinds of malicious actors—often referred to as ‘Black Hat Hackers’—to infiltrate the IT environment and steal, destroy or steal then destroy confidential data and try to extort large sums of money to get it back. As well as these third-party active threats, firms must also protect against the accidental cyber breaches or errors by the IT team such as missing patches, not changing default passwords, these “Innocent” issues can be just as damaging as aggressive third-party actions.

However, while focusing on newer threats such as phishing, whaling, impersonation attacks and the strategies to mitigate them (such as Penetration Testing, Endpoint Detection and Response, Extended Detection and Response, Managed Detection and Response) the basics can be neglected, leaving organisations exposed to issues which could be mitigated through simpler strategies implemented thoroughly.

Below I outline some things to consider around your organisation’s approach to user access control.

HR Processes

Every IT team has had senior staff at their desk pushing for a new user account to be set up immediately, if not sooner, because they have recruited someone to start in their team but the information hasn’t filtered through to HR or from HR to IT.  Having a well-documented and diligently followed process for a user’s journey through your organisation is key to ensuring that the risk of unauthorised access being granted is minimised.  If you have access to a workflow solution that can trigger all the necessary steps in the correct order and to the correct people to action them this will simplify things; however, it needs to be underpinned by an unambiguous policy.

• • Users should only be setup and allowed to access the system once you have verified their identity, right to work, and have a signed contract in place. HR are usually best placed to manage this and to lead on processes to ensure that you are not granting precious access to your environment to someone who isn’t who they say they are.  Whether to allow users to access systems before their contractual start date is a business decision – but agree what that policy is and stick to it to avoid any issues around people having access too soon and then potentially walking away with data and no contractual comeback.

• • Equally, if not more, important is IT working hand-in-glove with HR on restricting/removing access promptly when someone leaves or must have their access restricted for some reason. This is often just a matter of making sure that any system access is disabled as soon as the person’s contract has ended.  With the proliferation of systems with (potentially) their own authentication mechanisms, this can be a major challenge.  Implementing some form of Single Sign-On where available should minimise the risk as disabling the user’s main (often Azure) account can also remove access to other systems which use the same authentication system

• • In more unusual circumstances, such as temporarily disabling access due to a disciplinary investigation or the need to lock out an account quickly due to an unexpectedly early termination of contract (as seems to have been the case at the British Museum), it is important to make sure that someone trusted is lined up to disable any access before the affected person is informed. Leaving a user alone to “tidy things up” before being escorted off the premises, or leaving them with the potential to access the environment remotely even though their dedicated device has been taken away is a gaping hole through which confidential data could be exfiltrated, systems could be tampered with, or inappropriate communications sent to colleagues and clients.  Where the environment is managed by an external provider it is essential that you have a process agreed with them in advance to deal with departing staff members. For example, a request to lock the account at a specified date and time made via one or two named contacts to ensure that the work is completed correctly, and confirmation from them that the action has been taken.  Simply logging it as a “standard” service desk job risks it being prioritised wrongly and not actioned in time, leaving the account accessible and vulnerable to misuse.

Prevention Strategies

Every IT team has had senior staff at their desk pushing for a new user account to be set up immediately, if not sooner, because they have recruited someone to start in their team but the information hasn’t filtered through to HR or from HR to IT.  Having a well-documented and diligently followed process for a user’s journey through your organisation is key to ensuring that the risk of unauthorised access being granted is minimised.  If you have access to a workflow solution that can trigger all the necessary steps in the correct order and to the correct people to action them this will simplify things; however, it needs to be underpinned by an unambiguous policy.