MSPs
Want to improve security for customers?
Look out for Initial Access Brokers, says Karun Malik, vice president channel and strategic alliances at Qualys.
T
he IT industry is big. Really big. According to Gartner, spending on technology will be $4.3 trillion worldwide in 2023, up five
percent over the previous year. Within this market, there are thousands of different companies, from the largest vendors to distributors, resellers, service providers and specialist consultants. Today, those attacking IT networks operate in the
same way. Gone are the days of lone hackers working in darkened rooms. Instead, malware creation today is an industry, with threat actors operating their own technology as a service and HR and marketing teams to support their business operations. Different teams will cover different market areas, working on their specific skills and then selling to other companies or suppliers within the darkweb. Initial Access Brokers, or IABs, are essential to the malware market.
They are responsible for finding the entry point into company networks that can then be exploited. Typically, this will involve targeting companies’ perimeter devices for potential exploits or misconfigurations, abusing or stealing user credentials to get access, or using phishing attacks to gain a foothold in third-party websites and host malware. All of these techniques look to establish access within a victim’s network. Once that foothold is there, IABs will sell this access to other bad actors who can exploit the situation with ransomware, or carry this out themselves.
On average, it took 45.5 days for defenders to
patch and remediate the issues that IABs use in their attacks, compared to just 17.4 days to patch Windows and Chrome. This speed forces attackers to look further afield for their potential entry points and for more challenging attack paths. This also leads to attackers making more noise in their attempts, making it easier to spot those attempts and foil those attacks before they start.
Helping your customers So, now you are aware of how IABs target your customers. What can you do to improve the situation? The first point for security is to be aware of any externally facing systems that you or your
“IABs target the
digital equivalent of the window left
Understanding the targets IABs target the digital equivalent of the window left unlocked or the door that is mistakenly unlocked. To protect against these attackers, knowing their typical techniques and tactics can help you prevent problems for your customers. During 2022, there were 17 new issues added to the IAB toolkit. This list
customers have, as those will be the assets targeted by attackers. We have seen this recently with the MOVEit file transfer tool - this kind of software can’t be hidden away, as it has to be publicly accessible on the Internet as part of how it works, and it can’t be limited to known users or senders because this would stop the tool working effectively. When we are aware of these risks, we can watch them more closely for potential attacks. The second point is to monitor the external attack
unlocked or the door that is mistakenly unlocked.”
contains vulnerabilities in security devices, software languages and software products commonly used in businesses. Interestingly, the most common software products like Microsoft Windows or the Google Chrome browser are not on this list. Why? Because they get patched faster than any exploits or attacks can succeed. IAB groups target older and more niche issues they can use stealthily.
www.pcr-online.biz
surface that you have. This provides an ‘attacker’s eye view’ of what you or your customers have installed, so you can see any misconfigurations or critical issues. By looking at things in the same way as an IAB, you can
fix those problems before they are targeted by exploits. This process is not something that can be done once and then disregarded until next month or next quarter. Scanning for issues should be a continuous and automated process you can offer as part of your standard security service packages for customers. Even if nothing comes up, you should still
keep your eyes open for those new potential risks. If and when some new threat intelligence is released, you can automatically swing into action and implement mitigations or remediate your customers’ critical issues. The malware industry becomes more professional in its processes and
looks to make the most out of any security vulnerability. The security sector has to keep up as well. To achieve this in your operations, you can use automation and continuous scanning to spot problems, and then guide your customers through how to remediate those issues as fast as possible.
September/October 2023 | 17
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66 |
Page 67 |
Page 68
