The top 10 attack vectors most commonly exploited by attackers

On May 17, a joint security advisory released by cybersecurity authorities from multiple countries revealed the top 10 attack vectors most frequently exploited by cyber attackers.

The advisory was jointly released by agencies in the United States, Canada, New Zealand, the Netherlands, and the United Kingdom, and provides guidance to mitigate these frequently exploited weak security controls, poor security configurations, and bad security practices.

"Attackers routinely exploit poor security configurations (misconfigured or unsecure), weak controls, and other poor cyber hygiene practices to gain initial access or as part of other tactics to compromise a victim's system," the joint advisory reads.

Attackers' favorite techniques to gain initial access to a victim's network include exploiting internet-facing applications, exploiting external-facing remote services, phishing, abusing trust relationships with partners, and using compromised credentials.

The top 10 initial access vectors targeted by attackers using the above cyber compromise techniques are as follows:

• Multi-factor authentication (MFA) is not enforced. MFA, especially for remote desktop access, can help prevent account takeovers.

• Incorrectly applied privileges or permissions and errors in access control lists. These errors can prevent access control rules from being executed and may allow unauthorized users or system processes to access objects.

• Software is not up to date. Unpatched software can allow attackers to exploit well-known vulnerabilities to access sensitive information, launch denial-of-service attacks, or control systems.

• Use of vendor-supplied default configurations or default login usernames and passwords. Many software and hardware products are "out of the box" with overly permissive factory default configurations designed to make the product more user-friendly and reduce customer service troubleshooting time.

• Remote services, such as virtual private networks (VPNs), lack sufficient controls to prevent unauthorized access. In recent years, malicious actors targeting remote services have been observed.

• Strong password policies are not implemented. Attackers can use a variety of methods to exploit weak, leaked, or compromised passwords to gain unauthorized access to victim systems.

• Cloud services are left unprotected. Misconfigured cloud services are common targets for cyber attackers. Poor configuration can lead to sensitive data theft or even cryptojacking.

• Open ports and misconfigured services are exposed to the internet. This is one of the most common vulnerabilities. Cyber attackers use scanning tools to detect open ports and frequently use them as initial attack vectors.

• Failure to detect or block phishing attempts. Cyber attackers send emails with malicious macros (mostly Microsoft Word documents or Excel files) to infect computer systems.

• Poor endpoint detection and response. Cyber attackers use obfuscated malicious scripts and PowerShell attacks to bypass endpoint security controls and launch attacks on target devices.

▌ Best Practices to Reduce the Risk of Breaches

The joint advisory also provides practical recommendations to mitigate these issues, including using controlled access, hardening credentials (including MFA and changing default passwords), centralized log management, and antivirus and detection tools (intrusion detection and prevention systems).

The advisory also recommends that organizations always ensure that public-facing services use secure configurations and keep software updated through patch management programs.

For users, after updating virtual patches, it is impossible to quickly verify the effectiveness of the virtual patch in the face of real attacks. CyberTotal can release the latest attack verification libraries in a timely manner to help users quickly verify.

After official patches are released, many users cannot apply them immediately for various reasons. CyberTotal can also help users continuously verify the effectiveness of security defense measures, denying attackers the opportunity to exploit these vulnerabilities and ensuring the safe operation of business applications.

| Reference Source

https://www.bleepingcomputer.com/news/security/cybersecurity-agencies-reveal-top-initial-access-attack-vectors/