Whereas cybersecurity headlines are sometimes dominated by the newest zero-day or notable vulnerability in a vendor’s software program/product or open-source software program library, the truth is that many vital knowledge breaches have been and can proceed to be as a consequence of misconfigurations.
To underscore the intense of this difficulty, the US Nationwide Safety Company (NSA) and the Cybersecurity and Infrastructure Safety Company (CISA) not too long ago launched their “High 10 Cybersecurity Misconfigurations,” recognized by intensive pink and blue group assessments and menace searching and incident response group actions.
For those who’re like most cybersecurity professionals, a lot of these things ought to come as no shock and should even appear “easy”, however because the saying goes, simply because one thing is easy doesn’t imply it’s simple, and in trendy advanced digital environments, addressing these fundamentals at scale is ever daunting.
The publication emphasizes how pervasive misconfigurations are in massive organizations, even these with mature safety postures, and emphasizes the necessity for software program suppliers to take a secure-by-design or default method, one thing CISA has been advocating for, publishing steerage on the subject earlier in 2024.
With that mentioned, let’s dive into the High 10 objects CISA identifies. Additionally, because the publication factors out, these are on no account prioritized or listed so as of significance, as every one by itself might be problematic and result in a pathway of exploitation by attackers.
Default configurations of software program and functions
One wouldn’t suppose in 2024 we might nonetheless be discussing the dangers of insecure default configurations of software program, however right here we’re. Points similar to default credentials, permissions, and configurations are nonetheless widespread assault vectors that get exploited.
For instance, having default credentials in broadly used industrial off-the-shelf software program and merchandise can create conditions through which malicious actors can establish these default credentials and exploit methods and environments through which they continue to be unchanged.
These defaults are sometimes broadly recognized and simple to seek out by even the least expert malicious actor, as they’re usually printed by the producers themselves. This could permit attackers to establish the credentials, change administrative entry to one thing they management, and pivot from compromised gadgets to different networked methods.
Along with default credentials on gadgets, CISA factors out that companies can usually have overly permissive entry controls and weak settings by default. They particularly name out issues similar to insecure Energetic Listing Certificates Companies, legacy protocols/companies, and insecure Server Message Block (SMB) companies.
If it looks like Microsoft has a big presence within the objects listed, it’s as a result of it’s also the most typical amongst merchandise the evaluation groups encountered all through their actions and, in fact, default credentials apart, Microsoft additionally reigns supreme atop the CISA Recognized Exploited Vulnerabilities (KEV) catalog. Generally being first isn’t so glamorous.
Improper separation of consumer/administrator privilege
Regardless of the industry-wide buzz about issues like zero-trust, which is rooted in ideas similar to least-privileged entry management, this weak spot nonetheless runs rampant. CISA’s publication calls out extreme account privileges, elevated service accounts, and non-essential use of elevated accounts.
Anybody who has labored in IT or cyber for a while is aware of that many of those points might be traced again to human habits and the overall calls for of working in advanced environments. Accounts are likely to combination permissions and privileges as folks rotate by totally different roles and duties, and these permissions hardly ever if ever get cleaned up.
Sources such because the Verizon Knowledge Breach Investigation Report have demonstrated yr after yr that credential compromise stays a key side of most knowledge breaches, these overly permissive accounts are mendacity in wait, a wealthy goal for malicious actors to abuse.
Inadequate inside community monitoring
If a tree falls in a forest and nobody is round to listen to it, does it make a sound? Equally, in case your community is being compromised and also you lack visibility, consciousness, and related alerting, are you ready to do something about it? No, and no.
The CISA publication demonstrates that organizations must have ample visitors assortment and monitoring to make sure they’ll detect and reply to anomalous habits. As mentioned within the publication, it isn’t unusual for evaluation and threat-hunting groups to come across methods with both inadequate networking and host-based logging or have it in place however not correctly configured and really monitored to have the ability to reply to potential incidents once they happen.
This enables malicious exercise to go on unfettered and extends the dwell time of attackers in victims’ methods with out detection. To bolster community monitoring and hardening the publication recommends readers try CISA’s doc “CISA Pink Group Shares Key Findings to Enhance Monitoring and Hardening of Networks.”
Lack of community segmentation
One other basic safety management that makes an look is the necessity to section networks, a follow once more that ties to the broader push for zero belief. By failing to section networks, organizations are failing to determine safety boundaries between totally different methods, environments, and knowledge varieties.
This enables malicious actors to compromise a single system and transfer freely throughout methods with out encountering friction and extra safety controls and bounds that would impede their nefarious actions. The publication particularly calls out challenges the place there’s a lack of segmentation between IT and OT networks, placing OT networks in danger, which have real-world implications round safety and security in environments similar to industrial management methods.
Poor patch administration
Patching is everybody’s favourite exercise in cybersecurity, proper? The High 10 publication factors out that failing to use the newest patches can go away a system open to being exploited by malicious actors by their focusing on of recognized vulnerabilities.
The problem right here is even for organizations who’re performing common patching, sources such because the Cyentia Institute have identified that organizations’ remediation capability, which means their skill to remediate vulnerabilities (which incorporates through patching) is subpar.
Organizations on common can solely remediate one out of 10 of each new vulnerabilities monthly, placing them in a perpetual state of affairs the place vulnerability backlogs proceed to develop exponentially and demonstrating why others similar to Ponemon and Rezilion discovered that organizations have vulnerability backlogs starting from a number of hundred hundreds to hundreds of thousands.
Couple that with findings from Qualys on attackers’ talents to take advantage of vulnerabilities round 30% quicker than organizations can remediate them and it’s a recipe for catastrophe — bear in mind, attackers solely should be proper as soon as.
Points cited embrace an absence of normal patching in addition to utilizing unsupported working methods and firmware, which means these things merely don’t have patches accessible and are not supported by distributors. I’d personally add the necessity for organizations to make sure they’re making use of safe open-source elements and utilizing the newest variations, which can be one thing that many organizations battle with and helps contribute to the rise in software program provide chain assaults.
Bypass of system entry controls
We’ve mentioned the necessity for entry controls fairly a bit, however some conditions permit malicious actors to bypass system entry controls. The steerage particularly factors out examples similar to accumulating hashes for authentication data similar to pass-the-hash (PtH) assaults after which utilizing that data to escalate privileges and entry methods in an unauthorized method.
Weak or misconfigured MFA strategies
On this misconfiguration we once more see CISA and the NSA focus on the danger of PtH-type assaults. They level out that regardless of the usage of MFA similar to good playing cards and tokens on many Authorities/DoD networks, there’s nonetheless a password hash for the account and malicious actors can use the hash to realize unauthorized entry if MFA isn’t enforced or correctly configured. This drawback in fact can exist in industrial methods as effectively which can be utilizing Yubikeys or digital type components and authentication instruments.
Lack of phishing-resistant MFA
Regardless of the industry-wide push for multifactor authentication (MFA) for fairly a while, we face the stark actuality that not all MFA varieties are created equal. This misconfiguration and weak spot factors to the presence of MFA varieties that aren’t “phishing-resistant”, which means they’re weak to assaults similar to SIM swapping. Sources similar to CISA’s reality sheet “Implementing Phishing-Resistant MFA” may also help level directors in the best course.
Inadequate entry management lists on community shares and companies
It’s no secret that knowledge is the first factor malicious actors are after usually, so it isn’t a shock to see insufficiently secured community shares and companies on this record. The steerage states that attackers are utilizing feedback, OSS tooling, and customized malware to establish and exploit uncovered and insecure knowledge shops.
We in fact see this happen with on-premises knowledge shops and companies and the development has solely accelerated with the adoption of cloud computing and the rampant presence of misconfigured storage companies by customers coupled with low cost and intensive cloud storage, letting attackers stroll away with beautiful quantities of knowledge each when it comes to dimension and people impacted.
The steerage additionally emphasizes that attackers cannot solely steal knowledge however they’ll use it for different nefarious functions similar to intelligence gathering for future assaults, extortion, identification of credentials to abuse, and rather more.
Poor credential hygiene
Credential compromise stays a main assault vector, with sources similar to Verizon’s DBIR citing compromised credentials being concerned in over half of all assaults. The steerage particularly calls out points similar to simply crackable passwords or cleartext password disclosure, each of which can be utilized by attackers to compromise environments and organizations.
I’d add that with the appearance of cloud and the push for declarative infrastructure-as-code and machine identifies and authentication we’ve seen an much more explosive abuse of secrets and techniques, which frequently embrace credentials and are cited effectively in sources similar to safety vendor GitGuardian’s State of Secret Sprawl report.
This drawback can be why we proceed to see distributors implement secrets and techniques administration capabilities into their platforms and choices. This continues to affect even probably the most competent digital organizations as effectively, similar to Samsung who noticed over 6,000 secret keys uncovered of their supply code leak.
Unrestricted Code Execution
This one is easy, with the popularity that attackers need to run arbitrary malicious payloads on methods and networks. Unverified and unauthorized applications pose vital dangers as they’ll execute malicious code on a system or endpoint result in its compromise and likewise facilitate lateral motion or the unfold of malicious software program throughout enterprise networks.
The steerage mentions that this code may take varied types, similar to executables, dynamic hyperlink libraries, HTML functions, and even scripts in workplace software program functions similar to macros.
