One terminal server outside MFA, and a server estate encrypted or destroyed
Not yet reviewed
This one was written here from the source and has not yet been signed off, so it carries no byline. Every factual claim in it comes from the document linked below and can be checked against it. The judgements are ours, and until somebody has been back through them they are marked as unverified rather than presented as settled.
On 28 October 2023 a ransomware attack claimed by the Rhysida gang exfiltrated some 600GB of files from the British Library, encrypted or destroyed substantial portions of its server estate and locked all users out of the network. The first detected unauthorised access was at a Terminal Services server installed in February 2020 for trusted external partners and internal IT administrators, where access was not subject to MFA. The Library paid no ransom, the data was dumped on the dark web, and the rebuild of its infrastructure was still under way when the review was published.
What worked
At 00:21 on 26 October the Library's monitoring system automatically blocked suspect activity, and the IT Security Manager was alerted at 01:15. A different software system identified and prevented the encryption attack from executing on the laptop and desktop estates. Cloud-based email, finance, HR and payroll systems functioned normally throughout. The review says enhanced encryption protected the unedited Electoral Roll database, PCI DSS controls meant no credit card data was compromised, and backups unaffected by the attack were confirmed in December.
What failed
MFA was introduced in 2020 for cloud applications, but connectivity to the Library's domain and on-premise servers was left out of scope for reasons of practicality, cost and impact on ongoing programmes; the risk was raised and, in the review's words, perhaps under-appraised. After the 26 October alert the block was extended, a vulnerability scan came back with no results, and the account was given a password reset and unblocked later that day; the review now believes this was hostile reconnaissance. The legacy network topology allowed the attackers wider access than a modern design would have, and older defensive software on the server estate could not resist the attack. The 440GB that left the estate at 1.30am on 28 October was identified by Jisc only after the Library alerted it. Destroyed servers meant that secure copies of the collections had no viable infrastructure to be restored to.
The number
600GB
of files copied and exfiltrated, just under half a million documents, then dumped on the dark web when no ransom was paid.
What to do instead
Put MFA on every remote access route, supplier and administrator routes first, and give any exception made for cost or convenience a named owner and an expiry date. Treat a blocked intrusion as the start of an investigation: a password reset followed by an unblock is not a review. Segment the network so that one terminal server cannot reach the whole estate, and manage third-party access through privileged access management. Keep immutable offline backups, and also make sure there is somewhere clean to restore them to. Report accepted low-level risks to senior management in aggregate, a weakness the review identifies in the Library's own risk process.