Industry Voice: Stop leaving the door open for identity-based attacks

Every cybersecurity professional out there has heard the phrase ‘the landscape of cybersecurity is ever-evolving’ more times than they care to remember. But in the case of identity, it’s never been truer.

Just a few years ago, threat actors would have been focused on picking your customers’ virtual locks, searching high and low for vulnerabilities to exploit. But fast forward to today, while this remains a prominent threat, they’ve found another way in - opening the doors that organisations are leaving open with compromised credentials. And it’s far more common than you might think. As our Active Adversary Reportfound, compromised credentials were the leading root cause of all attacks, responsible for nearly double the amount of attacks originating from exploited vulnerabilities.

This is far from a one-off spike. Our Counter Threat Unit™ has seen the quantity of stolen credentials available for purchase on the dark web more than double in the last year alone. So how can you help bolster your customers’ defense strategies to include a comprehensive, layered approach to identity security?

Focus on the Fundamentals

Firstly, counsel your customers on good security hygiene when it comes to identity threats. A comprehensive lifecycle management process for human and non-human identities is essential. It can ensure the business is protected, not only so identities aren’t granted excessive permissions, or that permissions aren’t abused, but also that they aren’t left active after an employee has left. With the right management in place, customers can be alerted for example when a non-active identity suddenly becomes active again, which could be a sign that it’s been published and sold on a marketplace.

Aside from those credentials that might be published on the dark web, identity-based attacks like phishing are also on the rise, and they’re becoming smarter as attackers increasingly leverage AI to create increasingly sophisticated and convincing phishing messages. So a focus on strong, ongoing security training is crucial. To get ahead they must educate their teams on the tactics most used by attackers, and refresh this as the sector evolves.

Multi-Factor Authentication (MFA) should also be part of the conversation here. It adds an additional layer of security, requiring multiple forms of verification before any account or resource can be accessed. Even better, promote the use of phish-resistant passkeys as a more secure alternative to traditional passwords. It might feel like preaching to the choir but the availability of MFAs in breached organisations has actually worsened in recent years. In our 2022 Active Adversary Report, only 22% of victims did not have MFA configured, but in the latest Report, it had nearly tripled to 63%. Don't assume your customers have this in place - make it a central part of the identity threat management discussion.

Threat Detection and Response for the Identity Age

Threat actors won’t be moving on from identity-based attacks anytime soon, and no matter how many of the above measures your customers adopt, they can’t cover everything themselves.

While many organisations turn to Identity Access Management (IAM) systems as an answer here, it’s not a comprehensive security solution. Sure, it can manage access rights and give customers better control and visibility over their libraries of digital identities, but threat actors could still bypass or neutralise these controls through other means. And once a threat actor slips through using compromised credentials, they can siphon data silently, meaning that your customers might not even know until they get the ransom message.

It’s becoming increasingly clear that this new age of identity needs a new solution. Something that can both monitor and improve identity security posture but that can also detect and respond to attacks when they inevitably occur.

Identity Threat Detection and Response (ITDR) solutions do just that. A new, identity-focused take, complementary to managed threat response, ITDR solutions provide unified platforms with real-time visibility and threat response controls. They can detect anomalous behaviours such as unusual access requests or signs of credential abuse and enable organisations to proactively neutralise threats.

But the strongest solutions don’t just work in isolation. Solutions such as Sophos ITDR can integrate directly with Sophos Managed Detection and Response (MDR) and Extended Detection and Response (XDR) platforms to provide a comprehensive view of identity risks in your unique threat landscape. Continuously running over 80 identity posture checks, it allows organisations to identify and address gaps that go way beyond basic hygiene markers. Breaches and abnormal user behaviour associated with insider threats or stolen credentials are monitored for, alongside misconfigurations and security gaps, enabling organisations to shut those doors before attackers realise they’re open. It even scans the dark web and breach databases for evidence of leaked or stolen credentials.

Your customers don’t need to struggle with high manual effort using multiple tools to elevate their identity security; solutions like Sophos ITDR can do the hard work for them. To find out more, reach out to see how Sophos ITDR could help you find - and close - those open doors.

This article is sponsored by Sophos.