Cyber hygiene is at an all-time low
Well-known attacks and attack vectors remained successful because security personnel did not address vulnerabilities and apply patches according to a new report from cybersecurity and visibility business Ixia.
IT vendors created code or configurations that led to many successful security breaches in 2018, but IT operations and security personnel shared the blame due to ignorance of the latest patches and challenges in deploying patches in a timely manner.
In addition Ixia observed more new devices joining networks than ever before, but also more devices designed and deployed without proper measures to stop or even limit threats. Well-understood SQL injections and cross-site scripting vulnerabilities have been used by bad actors to target web applications. Code sharing poses a risk too, despite efforts by the open source community to standardize controls and measures in web development.
"Compromised enterprise networks from unpatched vulnerabilities and bad security hygiene continued to be fertile ground for hackers in 2018. Misconfigured security and access policies also were a major source of data breaches in 2018," says Steve McGregory, senior director, Ixia Application and Threat Intelligence. "Network and application complexity pose serious security threats and create new vulnerabilities every day. Hackers continue to leverage the complexity as well as existing vulnerabilities and misconfigurations to their advantage. It has never been more important for organizations to take a proactive approach to identify and mitigate such flaws as thoroughly as possible."
Among other findings, Ixia detected 662,618 phishing pages in the wild in 2018, and 8,546,295 pages hosting or infected by malware -- so a successful attack requires only a single errant click on an email or link. This makes people the weakest link in the security chain. A well-crafted and timed phishing attempt can encourage even savvy users to click on compromised links. Successful defense depends on a combination of proactive user education, blocking phishing attacks and malware that crosses the network edge, and detecting and blocking lateral movement in a network.
You can find out more about the findings on the Ixia website.
Image credit: joruba75/depositphotos.com