University Hires HBS Testing Team to Take Its Best Shot

Finding A Next-Level Partner

Troy University’s complex environment includes four campuses in Alabama, 20-plus support sites outside the state, 75,000 student accounts spread across the world, and partnerships with multiple organizations in Asia. As keepers of large amounts of personally identifiable information (PII), the university faces numerous compliance frameworks, including the Gramm-Leach-Bliley Act (GLBA).

With so much to protect, Troy has implemented a wide array of cybersecurity best practices. Along the way, Troy’s team realized it needed to upgrade to a cybersecurity consultant who could deliver more than basic, off-the-shelf attacks. “We were getting templated reports that didn’t give us many productive things to do,” Greg says. “We needed someone who would take a very critical and professional look and try to break it.”

After a referral from a colleague, Greg interviewed HBS and hired the team to do a comprehensive risk assessment. HBS’s assessment won Greg’s confidence—and found few holes in the university’s policies and controls. Next up was the penetration test.

Pen Testers Square Off with the Security Team

During the scoping phrase, Greg asked HBS to test several IP addresses and web apps in a black-box format. The pen testers got almost no information about the environment they faced, and Troy’s security team got no warnings that would help them prepare their defenses. Greg told HBS’s team to focus heavily on network exploitation and the critical web apps exposed to the general public.

HBS’s team used automated scans to identify vulnerabilities, then tried to manually exploit weaknesses and pivot into the larger system. Typical of a heavyweight fight, the early rounds were a stalemate. The university’s artificial intelligence tools blocked much of the common reconnaissance hackers try. “Things you’d expect to see on 99% of web apps in the recon stage were pretty much knocked away initially,” Senior Penetration Tester Jason Moulder says.

Moving past the scans, HBS’s testers entered the real chess match against Troy’s security team. The testers customized their manual attacks with the kind of intel gathering that hackers would do. For example, Jason looked for news about research happening at Troy University labs, knowing that hackers love to target cutting-edge intellectual property.

When he started attacking the system, Jason quickly found “honeypots” that Troy’s team left as soft targets to bait hackers into revealing their methods. Sidestepping the traps, HBS went after the real targets—and found Troy’s human analysts waiting. Spotting anomalous activities, Troy’s team quickly isolated networks to prevent pivots. “Tools do a lot,” Jason says, “but not everything. That’s where the human aspect comes in. They were proactive, not reactive.”

HBS’s team accessed some information they could use to target users through their Google accounts or other outside vectors. But Troy’s system was mostly locked up tight. “Troy is a hard target because of the mitigations they have in place,” Jason says. “Stuff would start to work, but then they would pick up on the activity and shut it down. It’s good to know that they’re on top of things.”

But What About the End Users?

Cybersecurity conventional wisdom holds that it’s easier to hack a person than a server. But what about in an organization that provides constant security training? To find out, Troy University included an HBS phishing campaign designed to test the savviest users.

“When I described what I wanted to see, HBS said, ‘Are you sure?’” Greg says. “I told them that we bombard these users with things to enhance their awareness. Just throwing misspelled messages and a few odd logos at them isn’t going to work. Go after them, and we’ll see if they’re behaving properly.”

The phishing campaign went to more than 1,100 employees, including spear phishing messages targeted specifically at 30 high-ranking employees. The fake messages included Greg’s signature block and Troy University’s actual logo. One message asked users to click a link to a spreadsheet on SharePoint. The link led to a page that looked exactly like Troy’s login page. After the user input their credentials, the page blinked and loaded the actual IT service page. Most users would enter their credentials again, thinking the page had experienced a blip. The second login took them to their actual account, leaving users unaware that they’d given their credentials to an outside source.

Proving people still represent a soft target, HBS’s testers got the login credentials from 33 people in the main test and one person in the spear phishing test. “It only takes one to fail,” say  Tanner Klinge, who ran the phishing campaigns. “I have yet to see a campaign where no one gives up their credentials.”

Again, though, Troy’s strong cybersecurity program blocked any real damage. Most of the compromised Troy users quickly changed their passwords to block further action by the testers. And even with the other credentials in hand, HBS’s testers couldn’t pivot into broader attacks thanks to Troy’s use of network segmentation and multifactor authentication (MFA).

Making the Best Even Better

But like an all-star who keeps drilling on the fundamentals, Greg took the phishing campaign results as a kickstart for more training. “Despite all the substantial things we have going on, some users still fell for it,” he says. “We take that as an opportunity to address some training weaknesses.”

That kind of actionable information further validated Troy’s selection of HBS. “We got exactly what we expected,” Greg says. “It was not a boilerplate, templated report that anyone could’ve produced. It was very insightful. The tools were not off the shelf, and HBS used some very clever approaches just like the real bad guys do."