Whereas cybersecurity headlines are sometimes dominated by the most recent zero-day or notable vulnerability in a vendor’s software program/product or open-source software program library, the truth is that many vital data breaches have been and can proceed to be attributable to misconfigurations.
To underscore the intense of this subject, the US Nationwide Safety Company (NSA) and the Cybersecurity and Infrastructure Safety Company (CISA) lately launched their “High 10 Cybersecurity Misconfigurations,” recognized via in depth crimson and blue group assessments and menace looking and incident response group actions.
In the event you’re like most cybersecurity professionals, a lot of this stuff ought to come as no shock and will even appear “easy”, however because the saying goes, simply because one thing is straightforward doesn’t imply it’s straightforward, and in trendy complicated digital environments, addressing these fundamentals at scale is ever daunting.
The publication emphasizes how pervasive misconfigurations are in massive organizations, even these with mature security postures, and emphasizes the necessity for software program suppliers to take a secure-by-design or default method, one thing CISA has been advocating for, publishing steerage on the subject earlier in 2024.
With that stated, let’s dive into the High 10 objects CISA identifies. Additionally, because the publication factors out, these are by no means prioritized or listed so as of significance, as every one by itself could be problematic and result in a pathway of exploitation by attackers.
Default configurations of software program and purposes
One wouldn’t suppose in 2024 we’d nonetheless be discussing the dangers of insecure default configurations of software program, however right here we’re. Points equivalent to default credentials, permissions, and configurations are nonetheless frequent assault vectors that get exploited.
For instance, having default credentials in extensively used business off-the-shelf software program and merchandise can create conditions by which malicious actors can establish these default credentials and exploit programs and environments by which they continue to be unchanged.
These defaults are sometimes extensively identified and straightforward to seek out by even the least expert malicious actor, as they’re typically revealed by the producers themselves. This may enable attackers to establish the credentials, change administrative entry to one thing they management, and pivot from compromised units to different networked programs.
Along with default credentials on units, CISA factors out that providers can typically have overly permissive entry controls and weak settings by default. They particularly name out issues equivalent to insecure Energetic Listing Certificates Companies, legacy protocols/providers, and insecure Server Message Block (SMB) providers.
If it looks as if Microsoft has a big presence within the objects listed, it’s as a result of additionally it is the commonest amongst merchandise the evaluation groups encountered all through their actions and, after all, default credentials apart, Microsoft additionally reigns supreme atop the CISA Identified Exploited Vulnerabilities (KEV) catalog. Typically being first isn’t so glamorous.
Improper separation of person/administrator privilege
Regardless of the industry-wide buzz about issues like zero-trust, which is rooted in ideas equivalent to least-privileged entry management, this weak spot nonetheless runs rampant. CISA’s publication calls out extreme account privileges, elevated service accounts, and non-essential use of elevated accounts.
Anybody who has labored in IT or cyber for a while is aware of that many of those points could be traced again to human habits and the final calls for of working in complicated environments. Accounts are inclined to combination permissions and privileges as folks rotate via totally different roles and duties, and these permissions hardly ever if ever get cleaned up.
Sources such because the Verizon Data Breach Investigation Report have demonstrated yr after yr that credential compromise stays a key side of most data breaches, these overly permissive accounts are mendacity in wait, a wealthy goal for malicious actors to abuse.
Inadequate inside community monitoring
If a tree falls in a forest and nobody is round to listen to it, does it make a sound? Equally, in case your community is being compromised and also you lack visibility, consciousness, and related alerting, are you able to do something about it? No, and no.
The CISA publication demonstrates that organizations have to have adequate visitors assortment and monitoring to make sure they’ll detect and reply to anomalous habits. As mentioned within the publication, it isn’t unusual for evaluation and threat-hunting groups to come across programs with both inadequate networking and host-based logging or have it in place however not correctly configured and truly monitored to have the ability to reply to potential incidents after they happen.
This permits malicious exercise to go on unfettered and extends the dwell time of attackers in victims’ programs with out detection. To bolster community monitoring and hardening the publication recommends readers try CISA’s doc “CISA Purple Workforce Shares Key Findings to Enhance Monitoring and Hardening of Networks.”
Lack of community segmentation
One other basic security management that makes an look is the necessity to phase networks, a follow once more that ties to the broader push for zero belief. By failing to phase networks, organizations are failing to ascertain security boundaries between totally different programs, environments, and knowledge sorts.
This permits malicious actors to compromise a single system and transfer freely throughout programs with out encountering friction and extra security controls and bounds that would impede their nefarious actions. The publication particularly calls out challenges the place there’s a lack of segmentation between IT and OT networks, placing OT networks in danger, which have real-world implications round security and security in environments equivalent to industrial management programs.
Poor patch administration
Patching is everybody’s favourite exercise in cybersecurity, proper? The High 10 publication factors out that failing to use the most recent patches can depart a system open to being exploited by malicious actors by their focusing on of identified vulnerabilities.
The problem right here is even for organizations who’re performing common patching, sources such because the Cyentia Institute have identified that organizations’ remediation capability, which means their capability to remediate vulnerabilities (which incorporates through patching) is subpar.
Organizations on common can solely remediate one out of 10 of each new vulnerabilities monthly, placing them in a perpetual scenario the place vulnerability backlogs proceed to develop exponentially and demonstrating why others equivalent to Ponemon and Rezilion discovered that organizations have vulnerability backlogs starting from a number of hundred hundreds to thousands and thousands.
Couple that with findings from Qualys on attackers’ skills to use vulnerabilities round 30% quicker than organizations can remediate them and it’s a recipe for catastrophe — bear in mind, attackers solely have to be proper as soon as.
Points cited embrace a scarcity of normal patching in addition to utilizing unsupported working programs and firmware, which means this stuff merely don’t have patches out there and are not supported by distributors. I might personally add the necessity for organizations to make sure they’re making use of safe open-source parts and utilizing the most recent variations, which can be one thing that many organizations battle with and helps contribute to the rise in software program provide chain assaults.
Bypass of system entry controls
We’ve mentioned the necessity for entry controls fairly a bit, however some conditions enable malicious actors to bypass system entry controls. The steerage particularly factors out examples equivalent to gathering hashes for authentication info equivalent to pass-the-hash (PtH) assaults after which utilizing that info to escalate privileges and entry programs in an unauthorized method.
Weak or misconfigured MFA strategies
On this misconfiguration we once more see CISA and the NSA talk about the chance of PtH-type assaults. They level out that regardless of using MFA equivalent to good playing cards and tokens on many Authorities/DoD networks, there’s nonetheless a password hash for the account and malicious actors can use the hash to realize unauthorized entry if MFA isn’t enforced or correctly configured. This drawback after all can exist in business programs as properly which can be utilizing Yubikeys or digital kind elements and authentication instruments.
Lack of phishing-resistant MFA
Regardless of the industry-wide push for multifactor authentication (MFA) for fairly a while, we face the stark actuality that not all MFA sorts are created equal. This misconfiguration and weak spot factors to the presence of MFA sorts that aren’t “phishing-resistant”, which means they’re weak to assaults equivalent to SIM swapping. Assets equivalent to CISA’s reality sheet “Implementing Phishing-Resistant MFA” can assist level directors in the proper path.
Inadequate entry management lists on community shares and providers
It’s no secret that knowledge is the first factor malicious actors are after normally, so it isn’t a shock to see insufficiently secured community shares and providers on this record. The steerage states that attackers are utilizing feedback, OSS tooling, and customized malware to establish and exploit uncovered and insecure knowledge shops.
We after all see this happen with on-premises knowledge shops and providers and the development has solely accelerated with the adoption of cloud computing and the rampant presence of misconfigured storage providers by customers coupled with low cost and in depth cloud storage, letting attackers stroll away with beautiful quantities of knowledge each when it comes to measurement and people impacted.
The steerage additionally emphasizes that attackers can’t solely steal knowledge however they’ll use it for different nefarious functions equivalent to intelligence gathering for future assaults, extortion, identification of credentials to abuse, and way more.
Poor credential hygiene
Credential compromise stays a main assault vector, with sources equivalent to Verizon’s DBIR citing compromised credentials being concerned in over half of all assaults. The steerage particularly calls out points equivalent to simply crackable passwords or cleartext password disclosure, each of which can be utilized by attackers to compromise environments and organizations.
I might add that with the arrival of cloud and the push for declarative infrastructure-as-code and machine identifies and authentication we’ve seen an much more explosive abuse of secrets and techniques, which regularly embrace credentials and are cited properly in sources equivalent to security vendor GitGuardian’s State of Secret Sprawl report.
This drawback can be why we proceed to see distributors implement secrets and techniques administration capabilities into their platforms and choices. This continues to affect even essentially the most competent digital organizations as properly, equivalent to Samsung who noticed over 6,000 secret keys uncovered of their supply code leak.
Unrestricted Code Execution
This one is simple, with the popularity that attackers need to run arbitrary malicious payloads on programs and networks. Unverified and unauthorized packages pose vital dangers as they’ll execute malicious code on a system or endpoint result in its compromise and likewise facilitate lateral motion or the unfold of malicious software program throughout enterprise networks.
The steerage mentions that this code can even take numerous kinds, equivalent to executables, dynamic hyperlink libraries, HTML purposes, and even scripts in workplace software program purposes equivalent to macros.
