Unauthorized Access

Reply
Highlighted
L3 Networker

Unauthorized Access

Hi All,
 
we had an unauthorised access to our firewall, after the access all the logs in the firewall have been deleted and configurations have been changed and committed. 
 
we need to which credential are used to login the firewall.
 
Now we found the ip address as well as what changes are they made.
 
there is any other chance for restoring  the deleted file.
 
Regards
Karthikeyan 
Tags (1)
Highlighted
Cyber Elite

Re: Unauthorized Access

@karthikeyanB,

If you don't have the logs anymore and you aren't sending them off of the firewall then you essentially don't have anything to view what credentials were used to make those changes anymore. I would recommend you simply have anyone with credentials change them. Same thing goes with restoring the configuration or log files, if you weren't already sending them elsewhere you have nothing to restore from. 

Just a few things I would really recommend you do to increase security:

  • Utilizes permitted-ips on the management interfaces to restrict management access to a few machines. 
  • Assuming that the GUI was open to the internet, absolutely stop doing this. If required restrict it to one external IP address under your control. 
  • Configure log forwarding so the logs aren't only on the firewall.
  • Configure log settings so you get alerted for any configuration change made to the device; and if that's to chatty for you at least configure an alert for when a commit is performed. 
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!