Analysing network logs, an administrator spots unusual connections at a WLAN router — regularly in the early morning and late afternoon. The cause: the WLAN router is configured insecurely, and people waiting at the bus stop in front of the company building are using the open network to browse. What sounds harmless opens an entry point into the corporate network.
Unauthorised use or administration of devices and systems (G 0.30) is one of the most versatile threats in the BSI IT-Grundschutz catalogue. It covers everything from an accidentally open WLAN access to a targeted attack with stolen administrator credentials.
What’s behind it?
Without effective mechanisms for physical, logical and access control, unauthorised use of systems can hardly be prevented or even detected. Even strong authentication mechanisms fail when the associated security features — passwords, tokens, smart cards — fall into the wrong hands.
Access paths
- Stolen or guessed credentials — Weak passwords, credential stuffing with leaked data, phishing attacks.
- Misconfigured services — Open management interfaces, default passwords on network devices, unprotected API endpoints.
- Physical access — Unsecured server rooms, unlocked terminals, accessible network ports in public areas.
- Removable media — At USB ports of unattended systems, data can be read or malware can be introduced.
- Lateral movement — From a compromised workstation of a user with limited rights, an attacker can gradually gain access to more highly privileged systems.
Impact
The consequences range from data theft through manipulation to complete takeover of the IT infrastructure. Unauthorised administration is particularly dangerous: an attacker with administrator rights can disable security measures, install backdoors and manipulate logs to cover their activities.
Practical examples
WLAN router with default configuration. A company operates a WLAN access point with the factory-set default password. External people connect and gain access to the internal network via WLAN. Since the network is not segmented, they have access to file shares and internal applications.
Stolen VPN certificate. An employee stores their VPN certificate unprotected on a private laptop. The laptop is stolen. The attacker uses the certificate to dial into the corporate network as a legitimate user. Since no additional authentication (MFA) is required, the access goes unnoticed.
Inactive admin account not disabled. An IT administrator leaves the company. Their privileged account is not locked promptly. Weeks later, logs show accesses via this account at unusual hours. Whether the former employee or a third party is using the credentials cannot initially be determined.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 45 mapped controls below in the section ‘ISO 27001 Controls Covering This Threat’.)
Prevention:
- A.8.5 — Secure authentication: Multi-factor authentication for all accesses, especially privileged ones.
- A.5.15 — Access control: Documented access control concept with need-to-know principle.
- A.5.18 — Access rights: Formal process for granting, modifying and revoking access rights.
- A.7.1 — Physical security perimeters: Physical protection of server rooms and network infrastructure.
- A.8.3 — Information access restriction: Least privilege principle at the application level.
Detection:
- A.8.15 — Logging: Complete logging of login events and privileged actions.
- A.8.16 — Monitoring activities: Automated detection of unusual access patterns and failed logins.
Response:
- A.5.24 — Information security incident management planning and preparation: Procedures for handling detected unauthorised access, including immediate locking of compromised accounts.
- A.6.5 — Responsibilities after termination or change of employment: Immediate deactivation of all accesses when employees leave.
BSI IT-Grundschutz
G 0.30 is linked by the BSI IT-Grundschutz catalogue to the following modules:
- ORP.4 (Identity and access management) — Central requirements for managing identities and access rights.
- NET.1.1 (Network architecture and design) — Network segmentation and access control at the network level.
- SYS.1.1 (General server) — Protection of administration and access control for servers.
- INF.7 (Office workplace) — Physical security at the workplace, screen lock, clean desk.
Sources
- BSI: The State of IT Security in Germany — Annual report with findings on access-related attacks
- BSI IT-Grundschutz: Elementary Threats, G 0.30 — Original description of the elementary threat
- ISO/IEC 27002:2022 Section 8.5 — Implementation guidance on secure authentication