A misperception about what is most important in cybersecurity

[sanjida708]

The most impressive and sophisticated attacks probably don’t represent the type of threat that should concern most businesses.

When we hear about a new security breach, we assume that attackers have used a never-before-seen exploit to exploit a zero-day vulnerability in order to attack a company’s defenses. However, this scenario is often far from the reality in most cases. While it is true that nation-state-backed cybercriminal groups tend to use zero-day vulnerabilities to infiltrate a nation’s most important targets, those targets are not you, and they are probably not your company either.

At the last edition of the Virus Bulletin conference , held in cyprus phone number data early October this year, as in previous years, we heard many stories about attacks against high-profile financial targets. But in the end, the malicious actors did not manage to compromise these targets with terrifying exploits , but instead managed to get into the systems with a phishing email or, as in the case described by a RiskIQ presenter , by using open permissions on a popular cloud resource.

The reality is that the weakest link in the security industry is that cybercriminals prefer the path of least resistance, which is often misconfigured security software, human error, or other operational security issues. In other words, it’s not about the sophisticated techniques used by a super-hacker, it’s about what we do.

If we believe we are doing everything right within our own organization, that may not be enough. While we may have fully secured our own network, the people we interact with may not be as protected. We may think we have successfully rejected third-party software, that we do not use the cloud for collaboration, and therefore feel we are on safe ground. However, other users in the supply chain may be using cloud services in risky ways. And sometimes neither we nor they know that this situation creates significant risk to both environments.

However, there are many things we can do.

The biggest security incidents that occur today often start with an external solution or service that you use. While we may have the best security team, they may not have a similar team.

If we're not sure, here are some obvious (or not so obvious) things we can ask our security teams:

Cloud Permissions
It is certainly convenient for computers that share resources in the cloud, especially for file sharing, to have full permissions on files so that anyone can add/change/remove access. But this can also be a problem. In the case of hastily assembled projects and teams, what often happens is that “temporary” resources are released into the cloud without considering best security practices. This often leads to everyone having open permissions as a way to ensure that everything “works”. And these resources often survive for years, with the risk of private information becoming publicly accessible.