GreyNoise Intelligence gives insights into 'Threat Detection events' via 2022 Mass Exploitation Report

Within the organization's set up, one can mitigate the common cybersecurity risks through a firewall, employee awareness, and stringent policies etc. However, when employees are working remotely, putting up cybersecurity measures becomes difficult. A recent survey from the UK and US-based security firm, Tessian, found that 56% of senior IT technicians believe their employees have picked up bad cyber-security habits while working from home. Some of the top cybersecurity risks associated with remote work include unsafe networks, use of personal devices, human error etc. Implementing security measures such as VPNs, anti-phishing tools, anti-virus, constant employee education etc. can help to mitigate the risk to a great extent.

Organizations are rapidly using the cloud to fast-track their digital transformation journey. Despite the increasing adoption of cloud, the data security still remains a key concern for many enterprises. Some of the top causes of cloud vulnerabilities are improper management of RDP (Remote Desktop Protocol), misconfigurations, weak authentication, and shadow IT use etc.

Digital transformation is about becoming data-driven. The Internet of Things (IoT) is one of the key providers of that data. IoT devices are vulnerable mostly because they lack the necessary built-in security controls to defend against threats. As per Kaspersky, IoT cyberattacks have more than doubled in 2021 compared to the previous year. Vulnerabilities in IoT devices allows cyber criminals to gain access to the sensitive data and to further launch attacks against other connected systems.

The traditional story of ransomware was one of malicious code rapidly encrypting files with public-key RSA encryption, and then deleting those files if the victim did not pay the ransom. The 'Double Extortion Ransomware Attack' aka 'pay-now-or-get-breached' involves threat actors stealing data from organizations in addition to encrypting files. This means that, in addition to demanding a ransom to decrypt data, attackers can later threaten to leak the stolen information if an additional payment is not made.

Credential stuffing is a cyber-attack in which credentials obtained from a data breach on one service are used to attempt to log in to another unrelated service. Such attacks are on the rise due to the more sophisticated bots that simultaneously attempt several logins, and appear to originate from different IP addresses. The main reason that credential stuffing attacks are effective is that many users reuse the same username/password combination across multiple sites. If this practice continues, credential stuffing will remain a serious threat.