What happened with MGM Casinos?

You may have heard that MGM Resorts International was hacked—boy, were they hacked.? In our digital world, a hacker can control access to hotel rooms, cash tickets for the slot machines, and everything in between.? Nearly all functions of several casinos on the Las Vegas Strip were halted as employees tried to revert to analog solutions.? While their Vegas casinos have slowly come back online, the MGM reward program is still down. It is very possible that the hackers were able to get away with MGM members PII like addresses and social security numbers.

?

So, what incredible hacking brought down a Global Enterprise like MGM?? It is “Vishing,” which is just phishing with a voice call.? Let’s review the anatomy of the attack with pictures of my dogs:

And that is it.? All it took was some research and a well-placed phone call to help desk workers to bypass millions of dollars of security and shut down half the strip.

Is this avoidable?? Absolutely.? Social Engineering attacks work because people don’t focus enough on training their staff and reviewing their own policies along with their operations and infrastructure.? On Amazon Web Services (AWS) , you can protect against these attacks, too.? When using third parties, you should ask for their procedures, such as MFA for IAM escalation, or their AWS Artifact to make sure they have checked their build and procedure.? Using Artifact you can make sure they have additional controls on their IAM controls to makes sure a single person cannot be fooled into given escalated access to an outside party. You can also use GuardDuty to watch for malicious activity and act when there is a possible breach. It would be able to notice an odd outside user with escalated access starting to try to access resources it wouldn't normally and set off an alert.

In the end, even with MSP, MSSP, or a huge investment in security devices, it makes sense for companies to routinely check themselves and third parties monitoring their environment.? Bringing in an expert to review procedure, infrastructure, and operational flow has huge value and is even essential for some more regulated industries.? If you are looking to find an expert to help with this process, please reach out to Oxford Global Resources .