• Search for:
    13Mar, 2023
    AI is taking phishing attacks to a whole new level of sophistication

    92% of organizations have fallen victim to successful phishing attacks in the last 12 months, while 91% of organizations have admitted to experiencing email data loss, according to Egress

    Not surprisingly, 99% of cybersecurity leaders confess to being stressed about email security. Specifically, 98% are frustrated with their Secure Email Gateway (SEG), with 53% conceding that too many phishing attacks bypass it.

    “The growing sophistication of phishing emails is a major threat to organizations and needs to be urgently addressed,” said Jack Chapman, VP of Threat Intelligence, Egress. “The signature-based detection used by Microsoft 365 and secure email gateways (SEGs) can filter out many phishing emails with known malicious attachments and links, but cybercriminals want to stay one step ahead. They are evolving their payloads and increasingly turning to text-based attacks that utilize social engineering tactics and attacks from a known or trusted source, such as a compromised supply chain email address.”

    “Unfortunately, phishing attacks will only become more advanced in the future, as cybercriminals use AI-powered technologies, such as chatbots, to automate and improve their attacks, such as adding video and voice capabilities to text-based phishing,” Chapman concluded.

    Inbound and outbound email security

    The report investigates both inbound phishing attacks and outbound data loss and exfiltration, highlighting the importance of a holistic approach to email security.

    Interestingly, 71% of surveyed cybersecurity leaders view inbound and outbound email security as a unified issue to tackle, recognizing their interconnected nature. The survey goes on to examine the technical controls and security awareness and training (SA&T) programs in place to reduce email security risk.

    Sophistication of phishing emails cause major financial losses

    86% of surveyed organizations reported that they were negatively impacted by sophistication of phishing emails, and 54% suffered financial losses due to customer churn following a successful phishing attack.

    Additionally, 40% of incidents resulted in employees leaving the organization. Cybersecurity leaders found that 85% of successful account takeover (ATO) attacks began with a phishing email.

    Risky behavior lead to costly data loss

    The survey found that people making mistakes or taking risks to accomplish their tasks are more common than malicious insiders. In fact, 91% of cybersecurity leaders surveyed reported that data had been leaked externally by email.

    The top three causes for these incidents include reckless or risky employee behavior, such as transferring data to personal accounts for remote work, human error, including employees emailing confidential information to incorrect recipients, and malicious or self-serving data exfiltration, such as taking data to a new job.

    Furthermore, 49% of organizations surveyed experienced financial losses from customer churn following a data loss incident, and 48% of incidents resulted in employees leaving the organization.

    Too many phishing emails bypassing employee inboxes

    58% of cybersecurity leaders believed their SEG was not effective in preventing employees from accidentally emailing the wrong person or with the wrong attachment.

    Additionally, 53% of respondents reported too many phishing emails still made it to employees’ inboxes, while 50% of organizations found it takes a lot of administrative time to manage their SEG.

    Security awareness and training

    Although 98% of the surveyed organizations conducted some form of Security Awareness and Training (SA&T), 96% of them expressed concerns or limitations with their SA&T programs.

    59% of organizations reported that SA&T is necessary for compliance with regulations or cyber insurance, and 46% of organizations reported that employees tend to skip through SA&T as fast as possible.

    Additionally, 37% of organizations admitted they lack confidence that employees remember what they have been taught during SA&T, and 29% of organizations reported that employees find SA&T to be annoying.

    Email security is a necessity for stoping phishing attacks

    The report highlights that people need real-time teachable moments that alert them to threats and engage them at the point of risk to tangibly reduce the number of security incidents that occur.

    Data throughout the report highlights that advanced email security is a necessity for everyday business. Despite investments in traditional email security and SA&T, surveyed organizations remain highly vulnerable to phishing attacks, human error, and data exfiltration.

    The only way to change the situation is to use intelligent email security solutions that augment traditional SEGs and Microsoft 365, offering the defense-in-depth required with a layered security approach.

    Resource : https://www.helpnetsecurity.com/2023/03/08/sophistication-of-phishing-emails/?web_view=true

    6Dec, 2022
    How Windows 11’s Enhanced Phishing Protection guards your password

    One of the easier ways to steal a user’s credentials is through a convincing fake login page or application. An unwitting user can quickly give an attacker the crucial “in” to an organization’s systems with the everyday act of entering their password in the wrong place.

    Often a phishing attempt shows up in the form of an email that looks dangerously close to the real thing and directs a user to a fake login page. The truly convincing phishing attempts mimic the logos, verbiage, and layout down to the pixel.

    Often, the only giveaway is the URL, but there are ways to obfuscate and hide this as well.

    Protecting Users with Enhanced Phishing Protection in Windows 11

    To help combat the constant risk of password theft, Microsoft added phishing protection in Windows 11 Version 22H2.

    When enabled, Enhanced Phishing Protection is offered through Microsoft Defender SmartScreen. But what does this actually offer for users?

    Enhanced Phishing Protection inspects the URLs and any running processes to evaluate whether the site or application appears to possibly host malicious content or is insecure.

    If so, SmartScreen leverages telemetry data from a multitude of Microsoft security products to notify the user and block the offending site or application.

    As this integration is deeply integrated into Windows through operating system-level integration with Microsoft Defender, a deeper inspection of processes and URLs is available than many competing products offer. In addition, Enhanced Phishing Protection is offered as a baked-into Windows 11 capability without needing an additional install or license.

    If Enhanced Phishing Protection detects a user entered their Windows password into a website or an application, an alert and prompt are shown warning the user to change their password.

    If the password is simply entered into an application like notepad, the protection recommends that the user delete their password from that file.

    Windows 11 warning when you enter your password in Notepad

    This proactive approach helps keep users safe and doesn’t allow a potential attacker to take advantage of their newfound credentials.

    Real-World Consequences of Phishing Attacks

    Phishing campaigns are becoming all too easy for threat actors to create.

    A Phishing-as-a-Service (PhaaS) platform named Caffeine offers open registration and focuses on Microsoft 365 logins but with a subscription model and anti-detection and anti-analysis protections.

    The speed at which a new threat actor can attempt a realistic phishing attempt on a victim is becoming difficult to contend with.

    A real-world example of this is American Airlines. They found that an employee’s Microsoft 365 account was hacked. From this vantage point, multiple employee accounts were accessed and leveraged to send even more phishing emails from within the organization.

    In filings, the data breach appeared to affect over 1,700 employees and customers. American Airlines now has to offer compensation and protection against future threats. Not to mention the time investment it will take to secure and handle the damage done by the phishing attack.

    What to Consider While Configuring Enhanced Phishing Protection

    As with most solutions, there are several caveats. This integration only works with non-Windows Hello logins. If you do not use a password to sign into your computer, then the Enhanced Protection is unavailable.

    In addition, the browser-level integration only works with Chromium-based browsers at this time, which leaves Firefox out of the equation and Opera. As Microsoft Edge is Chromium-based, this makes sense for Microsoft but may not fit every organization’s requirements.

    For system administrators, the Enhanced Phishing Protection is configurable via Group Policy which makes organization-wide rollouts easier.

    These include settings such as whether to enable the feature, whether or not to notify a user of a malicious website, whether a password has been reused, or if an unsafe application has been detected.

    For those using Microsoft Endpoint Manager, add Enhanced Phishing Protection to your users with a profile and the relevant settings. Adding to that, those organizations using Microsoft 365 Defender view alerts in the Defender for Endpoint portal.

    The Other Side of the Coin: Specops Password Policy

    Microsoft’s Enhanced Phishing Protection is only part of the equation; keeping track of passwords and blocking weak ones is the other side of actively protecting users and your organization.

    With Specops Password Policy, you gain a constantly updated breached/stolen password list and powerful and customizable password policies.

    Phishing attacks resulting in lost passwords make quick work of infiltrating an organization. But, an organization with Enhanced Phishing Protection paired with Specops Password Policy and Breached Password List functionality ensures that your users stay safe.

    By scanning your accounts against a constantly updated list of over 3 billion+ breached passwords, when a stolen password is added to the list, you can take fast action and remove the potential vulnerability from your environment.

    With the Specops Authentication Client, upon password changes, instantly inform your users as to why their password won’t work, even more so if the password has been stolen through a sophisticated phishing scam.

    Specops Passwords offers much more than breached password protections; a slew of features exist to secure accounts and protect users from costly mistakes. Make sure that your users are using secure passwords by auditing existing accounts and providing invaluable feedback to make sure that your users know exactly what is expected.

    A few of the valuable features Specops Password Policy has:

    • Use custom dictionary lists to add words common to your organization.
    • Block user names, display names, specific words, consecutive characters, incremental passwords, and the reuse of a part of the current password.
    • Take advantage of granular GPO-driven targeting for any organizational unit (OU), computer, user, or group population.
    • Use Regular Expressions to customize requirements further.
    • Use helpful end-user client messaging at failed password changes.

    Combine Microsoft’s Enhanced Phishing Protection and Specops Password Policy to protect both your users and your environment. You can test out Specops Password Policy in your Active Directory for free, here.

    Resource : https://www.bleepingcomputer.com/news/microsoft/how-windows-11s-enhanced-phishing-protection-guards-your-password/

    22Oct, 2021
    Top 5 Attack Vectors to Look Out For in 2022

    Threat actors are continually looking for better ways to target organizations, here are the top five attack vectors to look out for in 2022.

    Malicious actors are continually looking for better ways to carry out successful cyber attacks. Whether motivated by a potential payday or the ability to access confidential information, cybercriminals have plenty of incentive to focus on what works best in achieving their goals. This article focuses on the top five attack vectors organizations should look out for and defend against in 2022.

    1. Phishing

    Phishing techniques use social engineering to trick victims into taking an action that helps an attacker compromise your network or access your sensitive information assets. Fraudulent emails purporting to be from authoritative company sources are the main phishing attacks that employees fall victim to. These emails persuade employees to reveal passwords for important applications or download malicious files to their devices.

    Some threat actors carry out phishing attacks using social media and networking platforms, such as Twitter or LinkedIn. Phishing scams remain such a widely used attack vector because of their efficiency. The potential rewards for very little effort make phishing scams highly attractive attack vectors requiring minimal technical knowledge.

    Some phishing scams target particular individuals because of their close proximity to sensitive information or because those individuals are likely to have administrative access to network resources. Some phishing scams are so convincing that they can fool even seasoned security professionals. A solid defense against phishing requires a dual approach of employee awareness and an anti-phishing email filtering solution.

    2. Stolen Credentials

    Stolen credentials continue to cause problems for businesses of all sizes. A 2021 report on data breaches found that stolen credentials were the initial attack vector used in 61 percent of breaches. Using stolen passwords is an easy way to masquerade as a genuine user and access sensitive information or infiltrate deeper into your network.

    It’s straightforward for threat actors to purchase bulk lists of stolen username-password credentials on the dark web. Other attack vectors such as phishing emails can be used to trick employees into disclosing their passwords, which cybercriminals then use to access your network.

    The problems posed by stolen credentials stem from a perfect storm of poor password hygiene and weak identity and access management controls. Employees regularly reuse their passwords across multiple applications and services, which means that a single stolen password could provide an easy entry route into your network. Many organizations provide excessive access privileges to users, which worsens the impact of a credential compromise by giving hackers access to administrative functions or critical systems.

    3. API Exploits

    Organizations can create new opportunities for growth through the use of APIs, which integrate their applications and service with other resources in the wider digital ecosystem. APIs facilitate communication between different apps and services. The use of APIs has become so widespread that many technologists say we’re living in an API economy.

    Ever on the lookout for new opportunities to get their hands on sensitive data, many threat actors realize that the proliferation of APIs may work to their advantage. Traditional security tactics cannot detect API attacks, so many organizations remain open to a breach or data exfiltration via APIs. This API security checklist provides best practices and considerations for closing off your APIs as an attack vector.

    4. Remote Technology

    The speed at which cyber attacks exploiting remote technology increased during the Covid-19 pandemic serves as a telling example of how threat actors dynamically adapt the attack vectors they use in response to changing conditions. A 2020 report found that 20 percent of organizations experienced a security breach due to remote work.

    The technologies used by organizations to facilitate remote work include virtual private network (VPN) connections and remote desktop protocol (RDP). These technologies let employees access business applications and resources from outside the physical location of their place of work.

    While the use of remote technology will likely reduce over time compared to at the height of the pandemic, it’s clear that remote work is here to stay in some capacity. Opportunistic threat actors know that with remote work not going away, there will be chances to gain entry to corporate networks by exploiting RDP and VPN connections.

    An actionable way to defend against remote access threats is to require multi factor authentication (MFA) for these connections. MFA requires users to provide another category of evidence that verifies their identity in addition to the standard username-password combination they use to log in. These distinct pieces of evidence can include a one-time password or a fingerprint scan.

    5. IoT Devices

    IoT devices include wearable devices, coffee makers, sensors, and cameras, all of which connect to the Internet. Many organizations don’t have visibility into all of their IoT devices. Furthermore, it’s common for IoT devices to use default credentials that hackers can easily guess.

    IoT devices are veritable storehouses of data about the environment they are in and the people that use them. A cyber attack on an IoT device could also be the initial entry point from which a hacker accesses your wider network and installs ransomware that locks down key systems.

    Organizations need a serious approach to secure their IoT infrastructures, including:

    • Full device visibility
    • Changing default usernames and passwords
    • Using strong passwords
    • Segmenting the network so that an IoT compromise can’t spread to key IT systems and assets
    • Update IoT devices on time

    Conclusion

    As we come into 2022, get your organization ready to combat these top five cyber attack vectors. Each of them calls for its own defense strategy to limit the chances of malicious threat actors successfully leveraging them to access or disrupt your valuable data and services.

    Source : https://securityaffairs.co/wordpress/123636/security/top-5-attack-vectors-2022.html