Watch for social engineering and spear phishing, bypassing MFA, targeting MSPs, and compromising cloud environments to emerge as areas of vulnerability.
In 2022 we saw threat actors accelerating the use of techniques that gained traction in, among them MFA bypass and exploitation of MFA fatigue. Reorienting the way you train employees around this type of evolved risk, explaining “we know this is burdensome but here’s why it’s important,” may be helpful.
We advise organisations to adjust to make MFA solutions more secure. For example, for some MFA solutions, the default validity duration for a session token can be reduced from 30 days to 12 hours, limiting the lifespan of a successful attack. The session can be tied to one device (ideally an enrolled device). Additionally, hardware tokens implementing FIDO2 seem to be the most resilient to MFA session theft.
With 45% of incidents now cloud-based according to some estimates, we will also see more compromise of cloud environments in 2023. Organisations can’t simply assume their cloud services provider is handling their cloud environment securely. Minimum security requirements should be established, used when vetting MSPs, and included in contracts.
Furthermore, to avoid billing surprises, it’s advisable to set alerts for budget thresholds, and for when unexpected resources are launched or over-utilized. This allows organisations to quickly detect when their cloud environment is compromised or abused.
Technology IS keeping up with the threat landscape, but following up with all new security features and new security patches can be challenging, especially when IT security resources are tight. To assist, CIS Benchmarks are good best practices for technologies that you can impose on your MSP.
Ryan Stanley
Cyber Services Manager, Chicago, IL
We’ve recently witnessed different ways to bypass MFA. Here’s one example of how this attack is being executed:
The information set forth in this communication is intended as general risk management information. It is made available with the understanding that Beazley does not render legal services or advice. It should not be construed or relied upon as legal advice and is not intended as a substitute for consultation with counsel. Although reasonable care has been taken in preparing the information set forth in this communication, Beazley accepts no responsibility for any errors it may contain or for any losses allegedly attributable to this information. Non-insurance products and services are provided by non-insurance company Beazley affiliates and independent third parties. Separate terms and conditions may apply.
Technology IS keeping up with the threat landscape, but following up with all new security features and new security patches can be challenging, especially when IT security resources are tight. To assist, CIS Benchmarks are good best practices for technologies that you can impose on your MSP.
