The Imperative to Safeguard 6 Critical Attack Surfaces

Cybersecurity: Safeguarding the Six Main Attack Surfaces

Greater connectivity and enhanced digital operations have revolutionized the business landscape, offering numerous benefits. However, along with these advancements comes a need to defend against a broader and more dynamic range of cyber threats. While basic security hygiene can mitigate around 98% of cyberattacks, according to the Microsoft Digital Defense Report 2022, organizations must remain vigilant as cyberthreats grow increasingly sophisticated and coordinated.

Email Threats Abound

Phishing attacks have seen a staggering 61% increase from 2021 to 2022, with 35% of ransomware incidents involving email. In 2021 alone, these attacks cost businesses around $2.4 billion, as reported by the FBI. To combat this, organizations must focus on regular education and training programs for employees to enhance their ability to identify and report phishing attempts. With social engineering techniques becoming more realistic, it is crucial for everyone to understand their role in protecting the enterprise.

A Broader Definition Of ‘Identity’

Securing identity across the organization is crucial to protect access to systems and data. Threat actors are finding creative ways to circumvent multifactor authentication (MFA), such as adversary-in-the-middle phishing attacks and token abuse. Phishing kits readily available to threat actors have made it easier and more affordable to steal credentials. It is important to protect not only human identities but also automated ones, including cloud access, third-party accounts, and workload identities that are often overlooked during permissions audits.

Endpoints Provoke Concern

Managing an ever-growing array of endpoints adds complexity to security. Microsoft’s report reveals that, on average, 3,500 connected devices in an enterprise lack an endpoint detection and response agent. Unmanaged or unpatched devices not only become vulnerable to infection but can also serve as entry points for compromising an organization. Prioritizing improved endpoint visibility and security hygiene is critical to defend against these threats, especially when concerning servers that can lead to IP theft and ransomware attacks through subsequent access to user credentials and the network.

IoT Devices Can Create Additional Vulnerabilities

By 2025, IDC expects over 41 billion IoT devices in enterprise and consumer environments, working alongside operational technology (OT). With routers and networks becoming more hardened against attacks, threat actors increasingly target IoT devices. A study by the Ponemon Institute revealed that 35% of breaches originated from IoT devices, and many business devices run outdated software with well-known vulnerabilities. Improving IoT security is now being recommended or required worldwide. Organizations must have greater visibility into each connected device to mitigate risks effectively.

The Conundrum of Cloud

Cloud resources, whether single, hybrid, or multicloud, present unique security challenges. Many organizations struggle to gain end-to-end visibility across their cloud ecosystems, leading to potential security gaps. Shockingly, Microsoft’s research found that 84% of organizations experiencing ransomware attacks did not integrate their multicloud assets with their security tooling—a critical oversight. Misconfigurations and hidden code-based vulnerabilities in cloud apps can also pose significant risks. Addressing identity and misconfiguration gaps, along with implementing robust tools for attack response, is essential to securing the entire cloud environment, from the corporate network to cloud services.

Exponential External Exposure

Today’s external attack surface extends beyond an organization’s own assets, reaching multiple clouds, digital supply chains, and third-party ecosystems. This broad landscape makes it challenging to comprehend the full scope of external exposure. According to a Ponemon report, 53% of organizations experienced at least one data breach caused by a third party in the previous two years. To effectively defend against such threats, organizations must identify weak links in their defenses and understand potential entrance points as threat actors do. Achieving this requires both visibility through tools and strategies and the awareness gained from accurate, timely threat intelligence.

Editorial

The rapid advancements in technology and digitalization have brought immense benefits to businesses. However, they have also fostered a complex and ever-evolving cybersecurity landscape. Organizations must recognize that safeguarding against cyberthreats is imperative for their survival and success. The six main attack surfaces outlined—Email, Identity, Endpoints, IoT Devices, Cloud, and External Exposure—highlight critical areas where organizations must prioritize security measures.

To adequately address these challenges, organizations should focus on a multi-layered security approach. This includes implementing robust security protocols, regularly educating employees about evolving threats, conducting thorough permissions audits, and continually monitoring and updating endpoint devices and IoT systems. Furthermore, organizations need to secure their cloud environments by integrating security tooling and employing security-by-design principles.

Cybersecurity is not a one-time investment. It requires ongoing dedication, adaptability, and collaboration between organizations, security teams, and technology vendors. By being proactive in preventing cyberattacks, organizations can minimize the potential financial and reputational damage caused by successful breaches.

Advice

Building a resilient cybersecurity posture requires organizations to adopt a proactive mindset. Here are some recommendations for organizations to enhance their security measures:

1. Prioritize Employee Education:

Regularly train and educate employees about the latest phishing techniques and cyber threats. Reinforce the importance of scrutinizing suspicious emails and reporting potential phishing attempts.

2. Strengthen Identity Management:

Implement multifactor authentication (MFA) across all systems and accounts. Regularly review and update permissions to ensure only authorized personnel have access to critical resources. Consider the full range of identities, including humans and automated systems.

3. Improve Endpoint Security:

Deploy endpoint detection and response agents on all devices within the organization. Regularly update and patch devices to minimize vulnerabilities. Maintain centralized visibility and control over all connected endpoints.

4. Secure IoT Devices:

Implement stringent security measures for IoT devices, including timely software updates and patches. Monitor and manage the entire IoT device inventory to identify and mitigate vulnerabilities.

5. Strengthen Cloud Security:

Integrate security tooling with multicloud assets and ensure end-to-end visibility across the entire cloud ecosystem. Regularly audit cloud configurations and follow security-by-design principles when deploying cloud applications.

6. Assess Third-Party Risks:

Conduct thorough assessments of third-party vendors and partners to ensure they meet adequate security standards. Establish clear communication and guidelines for data sharing to minimize the risk of breaches through external channels.

By adopting these measures and remaining vigilant, organizations can significantly reduce the risk of cyberattacks and protect their invaluable data and operations.