How to tell when a masquerade attack is occurring?

Question

As I understand it, a masquerade attack is when an attacker acts as a registered/ authenticated user or entity in a system.

There are obviously ways to prevent this, for example user education, don't leave passwords around, etc. But of course hackers have other ways of getting user credentials.

This leads to the question; rather than preventing an attack, how do you respond to one? It seems that it isn't possible, as the whole point of a masquerade (or any attack) is to go unnoticed. Any insight will be appreciated.

Answer 1

Responding to an attack like this is a multi-step process. You need to:

1. Prevent

2. Detect

3. Respond and purge

Let's start with the prevent stage. An attacker can masquerade as another user in a multitude of ways: Physical, over the Internet or even over a phone call. In each of these cases, your attack mitigation strategies will be different:

Mitigating attacks over the internet:

• General checks - ensure that an attacker provides some sort of two factor authentication. The simplest example of this is a code that is displayed to a logged in user (a 'support pin') that is required to allow access to an account.

• Aggressively use OTPs. Customer wants a change made to an account? OTP. Lost their phone? Ensure that they answer security questions.

• Train your employees to be harsh. Sacrifice some customer happiness for security if necessary (don't overdo this.) Example - Customer calls up, sounds flustered and has conveniently lost their phone. Be brutal - don't be nice and fix things for your customer as a one time favor. Instead ask them for another form of verification (although note that a well-prepared attacker will have enough information to answer most security questions.)

Mitigating attacks over phone calls:

Use the same checks as above, plus:

• Use email verification for identity checks.

Mitigating Physical threats:

• Check for ID badges at every door/compartment.

• Train your employees not to allow tailgaters or flash someone in because they forgot their badges.

• Use a normal practice of treating every person as a threat until they've proven otherwise.

---

Now we come to the second part of this answer: The trick to detecting an attacker is to make their lives as hard as possible - employee training. train them to distrust any person and guard their information very carefully. Use security checks (like support codes). If someone fails to pass a security check, immediately escalate the issue. Don't help a customer just because they claim to have lost their identification proof(s). These little checks and their results are your detection mechanism. Someone fails them? Set alarms off.

This answer is very broad for a couple of reasons - your question is rather vague. I just detailed the basic process in this answer, but you'll have to port it to whatever you're trying to protect. Good luck!