Privileged accounts the 'signature' in advanced targeted attacks: CyberArk

• Privileged accounts being exploited as a ‘signature’ in such attacks
• Allows attackers to access secure networks and DBs, destroy breach evidence, etc.

NASDAQ-listed CyberArk has released a new report identifying the compromise and misuse of privileged accounts as a key signature common among advanced targeted cyber-attacks.
 
The Privileged Account Exploits Shift the Front Lines of Security report provides an expert’s vantage point into emerging patterns in targeted attacks by analysing the experiences of the world’s most renowned threat investigators in remediating the most devastating breaches, CyberArk said in a statement.
 
Participants included the Cisco Talos Security Intelligence and Research Group; Deloitte Financial Advisory Service’s Computer and Cyber Forensics Team; Deloitte & Touche’s Cyber Risk Services; Mandiant, a FireEye company; RSA, the security division of EMC; and the Verizon RISK Team.
 
“This coalition represents some of the smartest, most experienced and knowledgeable threat investigators in the world,” said CyberArk chief executive officer Udi Mokady.
 
“By understanding the commonalities they’re discovering across their investigations, we’re gaining significant insights into attack patterns for targeted attacks.
 
“What the research discovered was the exploitation of privileged accounts occurs in almost every targeted attack, and is the primary reason why attacks are so hard to discover and stop. These accounts empower attackers to access secure networks and databases, destroy breach evidence, avoid detection and establish backdoors that make it nearly impossible to dislodge them from networks.
 
“Securing privileged accounts represents the new first line of defence in the on-going cyber-battle companies are fighting,” he added.
 
Privileged accounts which consist of IT administrative credentials, default and hardcoded passwords, application backdoors and more, provide attackers with an ‘all-access pass,’ enabling them to go where they want, traversing a network without hindrances, CyberArk said.

These accounts are also critical for attackers to hide their tracks and to exfiltrate data. Once attackers gain privileged access to critical applications and systems, they become exponentially more difficult to stop, heightening the risk of data loss and business damage.

Key findings of the report include (click infographic on the right to enlarge):

• Every industry, every company is now a target: Cyber-attackers have broadened their targets, pursuing companies of all sizes, in all industries. This is often a means to an end: Attackers are frequently after their supply chain partners. Threat investigators have traced attacks to non-traditional targets such trucking companies and all types of professional services firms, from management consultants and auditors to litigation attorneys, frequently as a key step in an attack on a business partner.

• Perimeter resistance is futile: Attackers will get inside of perimeter security and the most likely infection point is employees. Phishing attacks are the most common vector and are growing in sophistication, making employee logins far easier points of infiltration than network or software exploits.

• Attackers stay hidden for months or years: Most attacks have been ongoing for 200 days or more before initial detection. Monetary attacks have a much shorter time to detection – typically less than 30 days. Attackers can cover their tracks using privileged accounts to delete log data and other evidence.

• Attackers covet privileged access: Privileged accounts are exploited in almost every targeted cyber-attack. The threat investigators claim that between 80% and 100% of all serious security incidents they’ve investigated featured the ‘signature’ of compromised and exploited privileged accounts in the attack process.

• Privileged accounts threat vastly underestimated: The risk and security vulnerabilities presented by privileged accounts are much greater than most companies realise. Companies underestimate how many privileged accounts they have and on what systems they reside. CyberArk’s research demonstrates that organisations today have at least three-to-four times as many privileged accounts as employees.

• Attackers’ exploits of privileged accounts increasingly sophisticated: Security investigators report a range of privileged account exploits – including repeated exploits in service accounts, to embedded devices in the Internet of Things (IoT) to establishing multiple identities in Microsoft Active Directory to ensure redundant access points and backdoors.

To download a free copy of the report, click here.
 
Related Stories:
 
Privileged accounts and insider threats
 
CyberArk unveils Master Policy, new approach to privileged account security
 
Expect more targeted attacks, crimeware: Trend Micro
 
 
For more technology news and the latest updates, follow @dnewsasia on Twitter or Like us on Facebook.