Prison sentences for the Transport for London attack

After nearly two years of investigation into the 2024 attack on Transport for London, Thalha Jubair (20) and Owen Flowers (18) were found guilty on 16 July. Both were leading members of the threat group Scattered Spider, and the attack led to an estimated GBP 29 million in loss and recovery costs. Each was sentenced to five years and six months imprisonment under the Computer Misuse Act. The investigation was led by the National Crime Agency with support from multiple law enforcement units.

What this means for you if you run the service desk

The most instructive figure in this case, to our mind, is the bill of GBP 29 million. Very little of it is about ransom. It is about recovery, downtime and remediation in an organisation that delivers critical public transport. If the service desk reports to you, though, the entry route is the part that concerns you most. Scattered Spider is known for a way in that is rarely technical, running instead through the service desk, password resets and persuasion.

That, in our view, is the uncomfortable part of this case for anyone in your seat. The control sits with people rather than with a product. It therefore has to be tested as a human control. You do not know whether a routine holds until it has been put under pressure. In our assessment the question is not whether your service desk is capable, but whether it is allowed to say no to someone who is in a hurry and sounds credible.

Berigo recommends

• Introduce a service desk verification routine for password and multi-factor resets that cannot be satisfied with information an attacker could look up online.
• Run social engineering exercises against the service desk, not only phishing against staff.
• Calculate what a week of downtime in your most critical service actually costs, and use that figure in budget discussions with the board.
• Ensure the recovery plan has been tested against a scenario where the identity platform itself is compromised.

Source

• nationalcrimeagency.gov.uk