Unit 1: Identities are the new perimeter · Lesson 4 of 4 · 18 min
Case file: one portal without MFA
Check every internet-facing way in for MFA, the way a single Citrix portal decided the Change Healthcare breach.
mission
- You are
- You are the identity engineer reviewing Kestrel's external entry points.
- Situation
- Kestrel requires MFA everywhere, according to the policy document. Policies describe intent; the list of entry points describes reality.
- Goal
- Find any internet-facing service where MFA is not enforced.
- Hand in
- The host name, its owner and when it was last reviewed.
case file
Change Healthcare Citrix Portal Without MFA
Change Healthcare (UnitedHealth Group) · 2024
On 12 February 2024 ALPHV/BlackCat affiliates logged in to a Change Healthcare Citrix remote access portal using compromised credentials, moved laterally, stole data and deployed ransomware nine days later. UnitedHealth CEO Andrew Witty testified to Congress that the portal did not have multi-factor authentication. The outage disrupted claims and pharmacy processing across the US for months, and UnitedHealth confirmed paying a ransom.
What went wrong
An internet-facing remote access portal accepted username and password alone, so a single set of stolen credentials gave network access.
What would have stopped it
- MFA (preferably phishing-resistant) on every externally reachable remote access service
- Inventory of external attack surface, including portals inherited through acquisitions
- Network segmentation and privileged access controls to limit lateral movement
- Offline, tested backups and continuity plans for critical clearinghouse services
What defenders could have seen
- Remote access sign-ins with no MFA claim, or from new IPs for that user
- Unusual lateral movement and credential use from the remote access host
- Large outbound data transfers in the days before encryption
List what faces the internet
Sort by Internet facing.
you should see Seven services face the internet.
Check MFA on each
Look down the MFA column for anything other than Required.
you should see citrix-legacy.kestrel.example: a legacy remote desktop gateway with MFA not configured.
defender tip Old remote access gateways survive migrations because a few people still use them. Find who, move them, then switch the gateway off.
Check when it was last looked at
you should see Last reviewed in February 2023, three years ago.
What a defender takes away
- 1MFA everywhere means every entry point, checked one by one.
- 2Legacy gateways are where policies quietly stop applying.
- 3Review internet-facing services at least yearly, with named owners.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.