In previous installments of The Attacker’s Playbook, we explored how human error (Part 1) creates the initial opportunity and how attackers exploit forgotten physical and digital entry points (Part 2).
But truth be told, we don’t always have to work that hard. Often, the “keys to the kingdom” are left right out in the open, in the form of default passwords, reused credentials, and sensitive data stored in the wrong places.
The simplest access control failures are often the most effective. We operate under the principle that default credentials are the same as having no authentication at all.
The Flaw: We find these “ghost keys” everywhere, from routers and medical software to printers. One of the most glaring examples involved finding cameras in medical rooms with live feeds of patients, accessible to anyone who knew the default password.
However, the risk extends beyond defaults. Attackers also hunt for the obscure Active Directory (AD) attribute known as “PassNotReq” (Password Not Required). If this is set to true, the user can circumvent password policies and set any password they want—including a blank one.
We use specialized tools like AD-RECON, an Active Directory reconnaissance tool developed by BreakPoint Labs, to quickly triage Bloodhound data and identify accounts with this attribute, as they are likely configured with weak or nonexistent passwords.
The Attack: An attacker will always start by checking for default credentials and password reuse. They look for exposed configuration files or scripts, such as a PowerShell script that sets the same local admin password across the network, which is essentially a reusable key to the entire kingdom.
In one engagement, we found a Domain Admin account from 2003 with a completely blank password. It’s important to note that this blank password wasn’t a default setting; It was a human-configured error that had remained undetected since its inception in 2003. Why did it persist for so long? Because vulnerability scanners generally don’t check AD password complexity or perform brute-force attacks, and pentesters often assume “blank” won’t work, so they don’t even try it.
The Result: A single default password can allow an attacker to gain a critical foothold, view sensitive patient video, or even achieve full domain takeover.
Mitigation Strategies: Basic security hygiene is non-negotiable.
So, why discuss passwords and data in the same post? Because they are the two halves of the “Keys to the Kingdom.” Passwords are the key, and the data is the treasure inside the chest. Once an attacker uses those weak credentials to get in, they immediately start hunting for the data you forgot about.
The Flaw: It’s extremely common to find Protected Health Information (PHI) and PII on systems where it has no business being. This data sprawl is typically the result of human error and a lack of training or convenience, like a doctor bypassing the secure network to use the Guest WiFi for faster internet access. We often find ourselves asking, “Why is there an exposed network share containing not just PHI, but old ransomware artifacts?”
The Attack: An attacker with internal access will hunt through these misplaced files. In one instance, we discovered dumps of email communications between thousands of students and their school’s healthcare center, filled with vast amounts of PHI and left on an easily accessible share.
The Result: This lack of data governance creates a massive, hidden risk. A single compromised workstation can lead to a catastrophic data breach if that station has access to years of forgotten, sensitive files.
Mitigation Strategies: Data governance is a critical, often-overlooked security control.
Leaving keys and sensitive documents out in the open is an invitation to attackers. Whether it’s a text file, an unlocked port, or a default password, poor security hygiene is an attacker’s best friend.
Key Takeaways:
PassNotReq) are invisible risks that standard scanners miss.Beyond compliance, protecting patient data is about resilience. Our security assessments simulate how attackers exploit these weaknesses, helping you find and fix them before they’re used against you.
So what happens once we’ve got the keys? That’s when the real damage begins. In the final chapter, we dive deep into the maze of internal trust—exploiting complex Active Directory paths that scanners can’t see. Part 4 is where persistence and privilege collide.
In an earlier post, we introduced Continuous Authorization to Operate (cATO), a framework that grants an organization’s systems or networks continuous authorization to assess whether they meet required security standards. In this part of our series on DoD cATO Evaluation Criteria, we discuss the critical role of Continuous Monitoring (ConMon), its integration with DevSecOps, and the challenges and best practices for its implementation.
ConMon lies at the heart of cATO, enabling real-time security monitoring rather than relying on periodic checks. Acting as a constant pulse check, ConMon identifies security risks as they arise, preventing issues from being discovered months later during an audit.
ConMon integrates seamlessly with existing security infrastructure, such as Security Information and Event Management (SIEM) systems, which aggregate and analyze security data, and Intrusion Detection/Prevention Systems (IDS/IPS), which monitor and prevent unauthorized access. By leveraging these tools, ConMon automates real-time security event responses, minimizing manual intervention. This proactive approach is critical for Components navigating an ever-evolving cyber threat landscape, and an essential element of the shift toward cATO.
Traditionally, the Authority to Operate (ATO) process involved a one-time assessment conducted every few years. While effective at the time, it left vulnerabilities unaddressed between assessments. cATO changes this by enabling continuous compliance and security without requiring lengthy review pauses. ConMon feeds real-time data into dashboards, helping agencies spot and address risks immediately.
For DoD Components, ConMon isn’t just a nice-to-have—it’s an essential aspect of a robust cybersecurity strategy. Without it, organizations are effectively flying blind between assessments, leaving potential security issues undetected.
ConMon continuously monitors network traffic, identifies vulnerabilities, and tracks configuration changes, ensuring that risks are addressed in real-time. This continuous feedback loop is key to maintaining a cATO, where security is constantly proven rather than checked periodically. By automating monitoring and ensuring immediate detection of security issues, ConMon provides federal agencies with the confidence that their systems remain secure and compliant.
While ConMon offers significant advantages, its implementation within the DoD information network (DODIN) can come with its challenges. The complexity of legacy systems, many of which were not built for real-time monitoring, poses a significant hurdle. However, deploying agent-based monitoring solutions can help gather security metrics without major modifications to existing infrastructure. Additionally, containerization technologies and API gateways can enable older systems to communicate with modern monitoring frameworks like ConMon.
Beyond technical challenges, implementing ConMon requires a cultural shift with endorsement at management and technical leadership levels. Security practices need to be integrated into every phase of software development, fostering a mindset of continuous improvement and security vigilance. DoD Components should consider a phased adoption approach, starting with their most critical systems and expanding as teams become proficient in using ConMon tools and interpreting the data they provide.
Other regulated industries, such as finance and healthcare, provide excellent examples of how continuous monitoring has been successfully implemented to meet strict regulatory requirements, like PCI-DSS and HIPAA. Banks, for instance, use real-time monitoring tools to detect and flag suspicious transactions, catching fraud as it happens. Similarly, healthcare providers leverage ConMon to secure patient data and Personally Identifiable Information (PII), proving that continuous monitoring not only improves security but also streamlines operations even in large, complex environments.
ConMon enables mission owners to respond to security threats as they arise, eliminating the need to wait for scheduled reviews. This real-time response minimizes downtime and keeps systems secure. A recent case study in the public sector demonstrated how ConMon reduced response times to cyber threats, potentially saving millions by automating vulnerability detection.
By automating many security tasks, ConMon reduces the need for manual assessments. This frees up resources for higher-priority initiatives and cuts costs associated with lengthy manual reviews.
ConMon helps mission owners detect security risks early, preventing them from escalating into more significant issues. This proactive approach ensures risks are understood and managed in accordance with the expectations of a DoD Authorizing Official (AO). It also supports continuous awareness and visibility into any security control deviations while reducing the risk of unauthorized access.
By integrating ConMon within cATO, agencies can maintain compliance without pausing operations for lengthy reviews. Instead, they stay secure, and risks are continuously understood and managed, all while keeping mission-critical systems running smoothly.
DevSecOps integrates security into every stage of the software development lifecycle, ensuring that applications are secure from development through deployment. One of the strengths of DevSecOps is its use of automated pipelines, where security checks are conducted continuously, allowing for faster development cycles while maintaining robust security standards.
Within the Continuous Integration/Continuous Deployment (CI/CD) pipeline, ConMon can be integrated to assess the security of code before it is deployed to production. By continuously scanning code repositories for vulnerabilities and ensuring that security checks are automated during the build process, ConMon ensures that new releases are secure from the outset.
ConMon complements this by providing real-time visibility into security risks throughout the DevSecOps pipeline. By combining these two approaches, mission owners can continuously monitor and secure their applications at every phase of the lifecycle, ensuring that security risks are immediately identified and addressed.
To implement ConMon successfully, DoD Components should start with – or leverage an existing – thorough assessment of their current IT infrastructure. By identifying mission relevant terrain – cyber (MRT-C) where real-time monitoring is critical, they can prioritize the systems that require ConMon integration. A phased roadmap for implementation, focusing on high-risk areas first, can provide a meaningful prioritization for the transition. Additionally, understanding how existing authorization boundaries are defined can be useful to scope transition efforts to a cATO. Finally, DoD Components should also invest in training teams to use ConMon tools effectively and interpret the data they provide.
Amid the constantly shifting cybersecurity landscape, older methods of periodic security reviews can’t keep up with the pace of modern threats. That’s where ConMon and cATO come in. Instead of waiting for audits, ConMon allows organizations to detect vulnerabilities and respond to risks in real-time, ensuring compliance and security are maintained without slowing down operations.
For many DoD Components, adopting cATO is no longer just a choice—it’s becoming the norm. It ensures systems stay secure and compliant without the constant need for manual security checks, allowing mission-critical operations to continue uninterrupted.
At BreakPoint Labs, we specialize in helping DoD mission owners navigate the complexities of ConMon and cATO. With our expertise, we can help organizations implement these essential cybersecurity frameworks seamlessly and effectively. Contact us today to strengthen your agency’s security posture and ensure continuous compliance.