It should be hard for malicious hackers to break into systems, but all too often it isn’t.

That’s a takeaway from a joint cybersecurity advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), the NSA and FBI, and their counterparts in Canada, New Zealand, the Netherlands, and United Kingdom.

The advisory, which is titled “Weak Security Controls and Practices Routinely Exploited for Initial Access”, explains that cybercriminals regularly exploit the poor security configuration of computer systems – whether it be because they’re misconfigured or simply left unsecured in the first place. In addition, malicious hackers exploit weak controls and other poor practices “to gain initial access or as part of other tactics to compromise a victims’ system.”

According to the report, just a small number of techniques are commonly used by attackers to compromise systems:

  • Exploitation of a public-facing application. This might often be an internet-facing service such as a website that may have a weakness that can be exploited to cause unexpected behaviour.
  • Exploitation of external remote services such as VPNs, and other methods of accessing the internal network from external locations.
  • Phishing
  • Leveraging trusted relationships. An attacker might have breached an organisation or service provider which has access to your organisation as a result of having a historic trusted relationship.
  • Abuse of compromised credentials could allow an attacker to bypass access controls, and even breach restricted areas of the network.

These attacks often exploit situations where multi-factor authentication (MFA) has not been enforced, mistakes in access control lists, software that has not been updated, weak passwords, and misconfigured services exposed to the internet.

“As long as these security holes exist, malicious cyber actors will continue to exploit them,” said NSA Cybersecurity Director Rob Joyce. “We encourage everyone to mitigate these weaknesses by implementing the recommended best (Read more...)