T0153 - Compromised developer workstation
Compromised developer workstation attack is a technique where an attacker gains access to a developer's machine, which contains sensitive information such as access credentials, keys, and code repositories.
This technique can allow an attacker to steal code or modify it to include backdoors or other malicious code.
The attacker can also use this access to gain entry into other systems within the organization.
This type of attack can be carried out through various means, such as Phishing, Typosquatting, Brandjacking, malicious IDE extensions, or exploiting vulnerabilities in the developer's system.
Once the attacker gains access, they can install malware or backdoors, extract sensitive information, or use the machine as a foothold to carry out further attacks.
ID: T0153
Type:
Technique
Tactic:
Initial Access
Summary:
Compromised developer workstation
State:
draft
Mitigations
id
type
summary
description
M1530
Mitigation
Use multi-factor authentication
Implement multi-factor authentication (MFA) for all users, including developers, to reduce the risk of unauthorized access to their workstations and other resources.
M1531
Mitigation
Implement endpoint security solutions
Implement endpoint security solutions such as antivirus, endpoint detection and response, extended detection and response to prevent malware and other malicious activity on developer workstations.
M1532
Mitigation
Implement least privilege access controls
Limit access to sensitive resources and data to authorized personnel only, and implement least privilege access controls to prevent unauthorized access to sensitive information.
M1720
Mitigation
Implement regular patches and updates
Regular patches and updates are necessary to improve the security, performance, and reliability of software and systems.
They include bug fixes, security updates, and performance improvements.
Regular patches and updates also ensure compatibility with new technologies and can help maintain compliance with regulatory standards.
Failure to install patches and updates can leave systems vulnerable to security threats, cause system failures or crashes, and limit the functionality of software and systems.
Detections
id
type
summary
description
D1510
Detection
Implement Intrusion Detection System and anti-malware
An intrusion detection system (IDS) is a security tool designed to detect and alert on unauthorized access to a computer system or network.
Implementing intrusion detection systems (IDS) and anti-malware software can help to identify and block malicious activity.
IDS is a critical security tool that helps organizations to detect and respond to security incidents in a timely manner.
By providing real-time monitoring and analysis of network traffic, IDS can help organizations to stay ahead of potential threats and reduce the risk of a security breach.
D1520
Detection
Implement endpoint detection and response system
An endpoint detection and response (EDR) system is a security tool designed to detect and respond to security incidents on endpoints, such as desktops, laptops, servers, and mobile devices.
There are several reasons why an EDR system is essential for maintaining the security of endpoints:
1. Threat Detection: EDR can detect and alert on a wide range of threats, including malware, ransomware, and other types of attacks that may not be detected by traditional antivirus software.
2. Rapid Incident Response: EDR can help security teams to rapidly detect, investigate, and respond to security incidents on endpoints. EDR systems can provide detailed information about the scope and impact of an attack, enabling security personnel to respond quickly and effectively.
3. Behavioral Analysis: EDR can monitor endpoint behavior to detect and alert on suspicious or anomalous activity. This helps security teams to identify and respond to threats that may be missed by traditional signature-based detection.
4. Endpoint Visibility: EDR provides visibility into endpoint activity, including processes, network connections, and file activity. This helps security teams to identify potential attack vectors and take proactive measures to prevent future incidents.