Warehouse assessment for a multinational goods retailer

We found several good practices:

• Security policies and procedures were documented in detail.
• User workstations at one facility were hardened and patched regularly.
• Endpoint detection solutions were in place and able to detect basic threats, and several security controls had been implemented to harden the SMB protocol.

We also identified security gaps and risks:

• Several servers were running vulnerable legacy services, which could allow an unauthenticated attacker to access affected systems and potentially access or tamper with sensitive data such as names, credentials, and inventory listings.
• We observed minimal network segregation between subnets across sites and between different global organizational environments. This increased the available attack surface from a network security standpoint and could allow ransomware, such as WannaCry, to cause greater impact.
• None of the sites had network access controls in place, creating the possibility that an attacker with physical access to a warehouse could compromise the wider network security and potentially access sensitive information, including client data.
• Patching policies were inconsistent. Two sites were not patching Unix servers, increasing the risk of unauthorized changes to inventory lists.
• We also found weaknesses in corporate user access management through Active Directory. Three service accounts were members of the Domain Administrator (DA) group, and the DA group had 54 members in total. This significantly expanded the attack surface of the domain and shortened the path for an attacker to gain control of a high-privilege account.