{"id":18827,"date":"2022-04-21T09:00:37","date_gmt":"2022-04-21T17:00:37","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2022\/04\/21\/news-12560\/"},"modified":"2022-04-21T09:00:37","modified_gmt":"2022-04-21T17:00:37","slug":"news-12560","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/04\/21\/news-12560\/","title":{"rendered":"Discover the anatomy of an external cyberattack surface with new RiskIQ report"},"content":{"rendered":"

Credit to Author: Christine Barrett| Date: Thu, 21 Apr 2022 16:00:00 +0000<\/strong><\/p>\n

The internet is now part of the network. That might sound like hyperbole, but the massive shift to hybrid and remote work and a multicloud environment means security teams must now defend their entire online ecosystem. Recent ransomware attacks against internet-facing systems have served as a wake-up call. Now that Zero Trust has become the gold standard for enterprise security, it’s critical that organizations gain a complete picture of their attack surface\u2014both external and internal.<\/p>\n

Microsoft acquired RiskIQ in 2021 to help organizations assess the security of their entire digital enterprise.1<\/sup> Powered by the RiskIQ Internet Intelligence Graph, organizations can discover and investigate threats across the components, connections, services, IP-connected devices, and infrastructure that make up their attack surface to create a resilient, scalable defense.2<\/sup> For security teams, such a task might seem like trying to boil the ocean. So, in this post, I’ll help you put things in perspective with five things to remember when managing external attack surfaces.<\/strong> Learn more in the full RiskIQ report<\/a>. <\/p>\n

Your attack surface grows with the internet<\/h2>\n

In 2020, the amount of data on the internet hit 40 zettabytes or 40 trillion gigabytes.3<\/sup> RiskIQ found that every minute, 117,298 hosts and 613 domains are added.4<\/sup> Each of these web properties contains underlying operating systems, frameworks, third-party applications, plugins, tracking codes, and more, and the potential attack surface increases exponentially.<\/p>\n

Some of these threats never traverse the internal network. In the first quarter of 2021, 611,877 unique phishing sites were detected,5<\/sup> with 32 domain-infringement events and 375 total new threats emerging per minute.4<\/sup> These types of threats target employees and customers alike with rogue assets and malicious links, all while phishing for sensitive data that can erode brand confidence and harm consumer trust.<\/p>\n

\n

Every<\/em> minute<\/em>, RiskIQ detects:<\/strong>4<\/sup><\/p>\n

\u00b7       15 expired services (susceptible to subdomain takeover)<\/p>\n

\u00b7       143 open ports<\/p>\n<\/blockquote>\n

A remote workforce brings new vulnerabilities<\/h2>\n

The COVID-19 pandemic accelerated digital growth. Almost every organization has expanded its digital footprint to accommodate a remote or hybrid workforce. The result: attackers now have more access points to exploit. The use of remote-access technologies like Remote Desktop Protocol (RDP) and VPN has skyrocketed by 41 percent and 33 percent respectively as the pandemic pushed organizations to adopt a work from home policy.6<\/sup><\/p>\n

Along with the dramatic rise in RDP and VPN usage came dozens of new vulnerabilities giving attackers new footholds. RiskIQ has surfaced thousands of vulnerable instances of the most popular remote access and perimeter devices, and the torrential pace shows no sign of slowing. Overall, the National Institute of Standards and Technology (NIST) reported 18,378 such vulnerabilities in 2021.7<\/sup><\/p>\n

Attack surfaces hide in plain sight<\/h2>\n

With the rise of human-operated ransomware<\/a>, security teams have learned to look for smarter, more insidious threats coming from outside the firewall. Headline-grabbing cyberattacks such as the 2020 NOBELIUM attack<\/a> have shown that the supply chain is especially vulnerable. But threats can also sneak in from third parties, such as business partners or controlled and uncontrolled apps. Most organizations lack a complete view of their internet assets and how they connect to the global attack surface. Contributing to this lack of visibility are three vulnerability factors:<\/strong><\/p>\n