Cybersecurity Lessons from 2021

 

SecureWorks, an incident response service provider, covered over 450 incidents last year and recently published its feedback. 85% of the incidents they responded to were financially motivated and a further 5% were seemingly government-sponsored attacks. The remaining attacks were accidental or deliberate actions of employees.

43% of the initial access gained was through threat actors exploiting vulnerabilities in internet-connected devices and credentials theft represented another 18% of initial system access. These credentials can be obtained through the dark web, brokers, credential stealing, brute-force attacks, or password spraying. In previous years, credentials theft was the number one approach to compromising a target, so the focus for security professionals needs to shift to patching vulnerabilities.

The rise in multi-factor authentication may mean that attackers are focusing on exploiting vulnerabilities that do not require authentication. Alternatively, it can be easy for an attacker to exploit proof-of-concept code that is published shortly after a vulnerability is publicly disclosed. This can lead to wide scale exploitation of any vulnerable devices in multiple targets simultaneously.

Despite ransomware attackers being increasingly imprisoned for their actions and the US government prioritising ransomware the same with it does terrorism, SecureWorks has not seen a reduction in ransomware attacks in 2021.

Many of the attacks that relied on credential theft and abuse occurred because the target organisation failed to implement multi-factor authentication mechanisms at all or properly. However, attackers have been able to bypass MFA by exploiting legacy authentication protocols (e.g. IMAP and SMTP) which are either still in use or haven’t been disabled. These protocols cannot enforce MFA and pose a significant security risk to businesses.

Even when MFA is implemented correctly, users may still eventually decide to approve an MFA request if attackers continuously send them due to “notification fatigue”. To mitigate this issue, consider implementing MFA that request a code from the user rather than a one-click solution.

If an enterprise is using cloud solutions, carefully investigate all of the security components and controls offered by the cloud provider to ensure logging and controlled access is offered by the cloud service. It may be attractive for businesses to implement these cloud solutions, but there are security considerations that must be accounted for before moving resources online.

To prevent cyberattacks going forward, SecureWorks recommends that IT and security professional regularly perform vulnerability scans, control access carefully and make use of IP lists, monitor newly registered domains that spoof or impersonate your company, improve your backup strategies and procedures to mitigate ransomware attacks, implement MFA properly, and implement DKIM and SPF authentication for email clients to avoid fake emails being sent by attackers.

Of course, you should also ensure your systems and software and kept up to date, use the principle of least privilege for account access, and ensure you implement an endpoint detection and response solution.