The Future and Identity Attack Surface Management

Imagine a legacy email account that held “read access” to any account in your network. You might say “Hummm” and “Very Interesting.” But now imagine that your network was the size of Microsoft Corporation, could that be a catastrophic problem? In reality, the news could actually be worse, Microsoft is actively attempting to remediate and resolve this networkwide identity breach currently. The compromise and intrusion known as Midnight Blizzard has been a Cybersecurity nightmare for Microsoft since last year. Any quick online search will report the depth and breadth of this Russian attack and the problem spans both government and private industry.

Hacked private email, Viruses, Ransomware, Trojan Horses, Malware, Intellectual Property theft, Identity theft, etc., etc., With all of the security breach events we have all witnessed over the past few decades, what should we be most concerned about, what are the largest looming threats, and why? We asked industry experts and what they had to say was enlightening, also alarming, and it mostly seemed focused on the end-user and today’s modern attack surface which seeks to compromise an individual’s identity.

It’s a fact: It is impossible to say that an organization can stop cyber attackers 100% of the time, but there are new capabilities that blue-teams can deploy now to reduce their attack surface and, more specifically, their identity attack surface. “CDM” or Continuous Diagnostics & Mitigation is precisely one such capability. CDM is a critical $6 Billion + CISA / DHS Cybersecurity program rapidly spreading across government and private industry. Today, over 300 federal agencies have adopted CDM as an essential core capability for their internal risk management and quickly we have seen corporate American private enterprises following suit.

Recent breaches, beyond the astounding Midnight Blizzard attacks, show the detrimental impact of the identity attack surface—just look back at SolarWinds, U.S. OPM, Facebook, Experian, Marriott and so many other as public examples. At US ProTech, we’ve seen repeatedly where traditional multi-factor authentication (MFA) fails. With so many options for gaining initial network access, organizations must go beyond traditional MFA and well endpoint security and use identity protection methods that focus on stopping lateral movement and closing the backdoor for attackers. This objective is met when you have insight and control over any and all modifications to Users and Groups permissions.

Gaps in an organization’s identity security posture continue to expose its IT infrastructure and make it easy for Technical-Adversaries to gain access—essentially walking through an unlocked back door.

A wide range of Cybersecurity tools are entering the market to address these identity concerns. Examples of tools that track lateral movement include ANAMO and LATMA:

1. Anamo CDM delivers near Real-Time. Risk-Weighted. e-Discovery, and data analytics. Anamo is focused on internal e-Discovery and Forensics which capture lateral and vertical user movements along with many other attack vectors such as permission modification and software vulnerabilities. Anamo: https://anamo.io/
2. LATMA is an Open-Source and essentially connected to Active Directory (AD). It seeks to identify algorithms to identify suspicious movements. The tool works by using a series of techniques in the environment – collecting authentication traffic from AD.

No organization is immune to cyber threats, and the recent Midnight Blizzard attacks on Microsoft prove just that. Phishing attacks against major organizations will continue to prevail, and we can only expect threat actors to get more sophisticated and inconspicuous in the artificial intelligence (AI) era.