Page 67 - Cyber Defense eMagazine for September 2020

These findings are key to understanding the mechanics of a data breach. Attackers find weak links
through vulnerable frontline workloads and execute lateral movement, to progressively move through the
network and find more sensitive assets. According to our research, nearly 81 percent of organizations
had at least one neglected, internet facing workload.

Tip: Assume breaches will happen and look for lateral movement risks. Attackers will use secrets,
credentials and keys stored on breached servers to move laterally. Don’t wait for them to find these attack
opportunities – search for these risks beforehand to remove or tighten, as applicable.

Poor Password Security Creates Authentication Issues

Companies must also pay close attention to the authentication and verification methods used to grant
permission to frontline and internal workloads. Today, there is no excuse for organizations that do not
implement basic authentication protocols like multi-factor authentication (MFA).

Sadly, this is not the case, as we found that 23 percent of organizations have at least one cloud account
that does not use multi-factor authentication for the root account (super admin user).

Weak passwords and credentials also remain an issue for organizations to ensure the security of their
public cloud environments. More than 5 percent of organizations have at least one workload using an
easy-to-guess or leaked password, which is either a simple derivative of an existing password or has
been detected in a previous breach.

Cyber Defense eMagazine – September 2020 Edition 67
Copyright © 2020, Cyber Defense Magazine. All rights reserved worldwide.