Zum Hauptinhalt springen
Elementary Threat · BSI IT-Grundschutz

G 0.23 — Unauthorised Access to IT Systems

Updated on 4 min Reviewed by: Cenedril Editorial
A.5.6A.5.7A.5.9A.5.14A.5.15A.5.16A.5.17A.5.18A.5.19A.5.21A.5.24A.5.25A.5.29A.5.34A.5.35A.6.7A.7.7A.7.9A.7.10A.7.13A.8.1A.8.2A.8.3A.8.4A.8.5A.8.7A.8.8A.8.9A.8.12A.8.14A.8.15A.8.16A.8.18A.8.19A.8.20A.8.21A.8.22A.8.23A.8.27A.8.30A.8.31A.8.32 BSI IT-GrundschutzISO 27001ISO 27002

Every interface of an IT system is a potential entry point. An inadequately secured remote maintenance access, a forgotten API, a service with a default password — an attacker only needs one single vulnerable interface to gain access to the system. The defender has to protect them all.

Unauthorised access to IT systems is one of the most fundamental threats to information security. The BSI lists it as G 0.23. The access is often the first step of an attack chain — intrusion is followed by data theft, manipulation or sabotage.

What’s behind it?

Every interface — network port, USB socket, API, web interface, management console — offers legitimate users access to the system’s services. The same interface offers an attacker the opportunity to gain unauthorised access when authentication is too weak, software is vulnerable or the configuration is flawed.

Entry points

  • Captured credentials — usernames and passwords obtained through phishing, keyloggers, credential stuffing or database leaks. Password reuse makes this attack vector particularly effective.
  • Software vulnerabilities — unpatched security holes in operating systems, web applications or services. Publicly known exploits are automated within hours of CVE publication.
  • Insecure remote maintenance access — RDP, SSH, VPN gateways or proprietary remote maintenance tools with weak credentials or without multi-factor authentication.
  • Physical interfaces — USB ports that have not been disabled allow the connection of prepared devices. Unattended systems with open consoles invite direct access.
  • Misconfigurations — services that are unintentionally reachable from the internet. Management interfaces without authentication. Default credentials that have never been changed.

Impact

Unauthorised access primarily violates confidentiality (data access) and integrity (ability to manipulate). In many cases intrusion is the starting point for more serious attacks: ransomware deployment, data exfiltration, lateral movement within the network. The dwell time of an attacker in a compromised system averages several weeks — enough time for considerable damage.

Practical examples

Credential stuffing against a VPN gateway. An attacker uses a publicly available collection of stolen credentials (from earlier third-party breaches) and tests them automatically against a company’s VPN gateway. Since several employees use the same password for private and professional accounts, access succeeds. The attacker now has an encrypted connection into the internal network.

Unpatched web server as entry point. A company operates a web server with a known vulnerability for which a patch has been available for three months. An automated scanner discovers the weakness and installs a web shell. The attacker uses the web shell as a springboard for lateral movement and compromises the domain controller within a week.

Forgotten remote maintenance access. During commissioning of a production plant, the manufacturer sets up a remote maintenance access — with the agreed default password “service2020”. After commissioning, the access is forgotten; it remains active. Years later, an attacker finds the open port through an internet scan and logs in with the unchanged password.

Relevant controls

The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 42 mapped controls below in the section “ISO 27001 Controls Covering This Threat”.)

Prevention:

Detection:

Response:

BSI IT-Grundschutz

The BSI IT-Grundschutz catalogue links G 0.23 to the following modules:

  • NET.3.1 (Routers and switches)hardening and access protection for network components.
  • NET.3.2 (Firewall) — filter rules and segmentation as the primary barrier against unauthorised access.
  • ORP.4 (Identity and access management) — requirements for authentication, authorisation and permission management.
  • SYS.1.1 (General server) — hardening and protection of server systems.

Sources

ISO 27001 Controls Covering This Threat

A.5.6 Contact with special interest groups A.5.7 Threat intelligence A.5.9 Inventory of information and other associated assets A.5.14 Information transfer A.5.15 Access control A.5.16 Identity management A.5.17 Authentication information A.5.18 Access rights A.5.19 Information security in supplier relationships A.5.21 Managing information security in the ICT supply chain A.5.24 Information security incident management planning and preparation A.5.25 Assessment and decision on information security events A.5.29 Information security during disruption A.5.34 Privacy and protection of PII A.5.35 Independent review of information security A.6.7 Remote working A.7.7 Clear desk and clear screen A.7.9 Security of assets off-premises A.7.10 Storage media A.7.13 Equipment maintenance A.8.1 User endpoint devices A.8.2 Privileged access rights A.8.3 Information access restriction A.8.4 Access to source code A.8.5 Secure authentication A.8.7 Protection against malware A.8.8 Management of technical vulnerabilities A.8.9 Configuration management A.8.12 Data leakage prevention A.8.14 Redundancy of information processing facilities A.8.15 Logging A.8.16 Monitoring activities A.8.18 Use of privileged utility programs A.8.19 Installation of software on operational systems A.8.20 Networks security A.8.21 Security of network services A.8.22 Segregation of networks A.8.23 Web filtering A.8.27 Secure system architecture and engineering principles A.8.30 Outsourced development A.8.31 Separation of development, test and production environments A.8.32 Change management

Frequently asked questions

What's the difference between unauthorised access and a data leak?

Unauthorised access (G 0.23) describes unauthorised entry to an IT system — the attacker gains access. A data leak can be the consequence, but it is a separate threat (G 0.19): confidential data flows outward. Intrusion is often a prerequisite for a data leak, but data leaks without intrusion also exist (e.g. misconfigurations).

How do I effectively protect remote maintenance access?

Multi-factor authentication, VPN tunnels with current encryption standards, IP whitelisting and time-limited access. Remote maintenance access should only be enabled when needed and disabled afterwards. All remote maintenance sessions are logged.

Is a strong password enough for protection?

A strong password is necessary but not sufficient. Credentials can leak through phishing, keyloggers, third-party breaches or social engineering. Multi-factor authentication (MFA) provides protection even when the password has been compromised.