Illusive Joins CyberArk Marketplace

We’ve got some exciting news to share with you: we’ve just joined CyberArk Marketplace! As you may know, CyberArk offers the leading Privileged Access Management solution and is the only security software company focused on eliminating cyber threats that use insider privileges to attack an organization’s most critical assets and infrastructure. The CyberArk Marketplace delivers unprecedented simplicity and speed for security and IT operations teams to extend the benefits of securing privileged access across the enterprise – on-premises, in hybrid cloud environments, and throughout the DevOps pipeline.
Read More

Securing Identities Through Digital Transformation By Reducing The Attack Surface

The topic of accelerated (or forced) digital transformation has been top of mind during many of my recent discussions with customers.  It comes as no surprise that human-operated campaigns, such as ransomware, quickly and enthusiastically adapted to the entire global workforce now operating remotely, imposing many organizations to modernize their cyber resiliency and security operations.   From a more fundamental technology perspective, it may be a positive side benefit for organizations that had long term multi-year plans for digital transformation and are now embracing technology to enable their business.
Read More

Illusive Networks Advisory – SolarWinds Supply Chain Attack

Since last week and continuing into this week, details of the attack first perpetrated on FireEye and subsequently on the US Government Departments of Treasury and Commerce continue to evolve. We now know that the attack’s origin was the SolarWinds Orion IT management software versions 2019.4 HF 5 and 2020.2 HF 1, containing a backdoor (Sunburst). According to the FireEye analysis, this campaign may have started as early as spring 2020. We recommend you follow the remediation guidelines from SolarWinds, and any other organizations directly involved in the attack.

It’s still early, and industry knowledge about the attack remains incomplete, nevertheless we have learned enough to start developing plans to assess and reduce risk for organizations running the affected versions of SolarWinds Orion software. In this attack, as with most other advanced attacks like APTs and the new forms of targeted (human-operated) ransomware, attackers establish an initial beachhead, surveil their surroundings and move laterally to harvest privileged credentials that give them access to valuable information – “crown jewels”.
Read More

Easier Security Management Across Segmented Networks

Network segmentation—splitting up a network into smaller subnetworks—is a common practice, especially in large organizations. The benefits in segmenting networks include heightened network security, including better privilege management across different departments, isolating a successful attack (or other types of network failures) to a local network, and reduced attack surface, as well as better network performance through reduced congestion (fewer hosts in each subnetwork). Regulatory compliance can be a motivation as well. Additionally, previous mergers and acquisitions often necessitate that networks remain separate.
Read More

Preventing Attackers From Turning a Cloud Ecosystem Into a Security Nightmare

One topic we’ve written about a lot on this blog is lateral movement, when attackers leverage existing credentials and connections to move from one machine to another within an environment. When you add cloud to the mix, however, there are so many changes - from new attack vectors to methodologies and prioritizations - that the phrase seems incomplete.
Read More

Attackers Like Credentials More Than Exploit Kits, IAM & PAM

You're vulnerable. And cyber attackers know it. Read More

3 Ways Privileged Credentials Are Available to Cyberattacker

Preventing the ability of attackers to perform lateral movement within your network is not only a threat detection function—it’s also a cyber hygiene function. In this blog, we’ll review some of the most common—and invisible—ways that privileged user credentials proliferate in enterprise networks. It’s well understood that domain admin or other high-powered credentials are gold to a cyberattacker. With “keys to the kingdom,” they can move easily and silently from one system to another, change domain attributes, add permissions, change passwords, and connect to any machine in the domain. Most organizations dedicate significant resources to careful management of Active Directory and use various technologies and practices to control access privileges. But our experience shows that even in the most diligent organizations, privileged user credentials are more accessible to attackers than you’d think.
Read More