Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
Lara B. — Building Cyberr
North Korean IT workers are using fake identities to get hired by foreign companies. At the same time, fake recruiters are targeting IT professionals through malicious coding assignments and technical interviews.
The latest joint advisory from Japanese, US, Australian and German authorities reports at least 30,000 compromised devices across more than 100 countries and over $10.7 million in stolen cryptocurrency.
Japanese authorities have also dismantled the first North Korean laptop farm identified in Japan.
But there is another question worth discussing.
What happens when someone passes all your recruitment checks, gets hired and turns out to be a threat?
A verified identity, a convincing CV and a successful technical interview are important parts of the hiring process. But none of them guarantees what happens after someone gains access to company systems.
And this is not limited to North Korean IT workers.
Remote employees, freelancers, external contractors. How much access do we give them from day one? How do we monitor that access? And how quickly can we revoke it if something goes wrong?
The advisory covers recruitment screening, least privilege and access revocation.
I'd be interested to hear from CISOs and cybersecurity teams: How do you manage access for newly hired remote employees and external contractors?
Full article: https://www.securityweek.com/japan-dismantles-first-north-korean-laptop-farm-as-us-and-allies-detail-wider-scheme/
4 reactions · 1 comments
Comments
Danjuma A.: I need to read the full details of this