Tag: Security

So it’s 2019, and we’ve got phishing well in hand. Right?

Let’s face it, phishing is not new and forms of social engineering have been around for as long as we’ve been trying to protect information on the internet. Anyone who’s responsible for protecting their organization’s users from unsolicited spam or social engineering can tell you that phishing is definitely still occurring on a regular basis. What many organizations today don’t realize, is that not only is phishing still occurring, it’s becoming more complex, occurrences are increasing at an alarming rate, and users’ behavior is not changing at the same pace.

People Click Links

I had a great opportunity to hear a couple of my peers speak recently and they referenced Verizon’s Data Breach Investigations Report (DBIR) from 2018 and pointed out a few alarming trends. Phishing_Industries

First, let’s start with the scary one; sanctioned phishing campaigns uncovered that a small subset of individuals click on literally every link they get in their inbox:

“Unfortunately, on average 4% of people in any given phishing campaign will click it”

Phishing_ClickRate

Ok, so it’s only 4%. That’s not that bad, right? Well, consider a couple things; first, that individuals who have clicked on links in the past are far more likely to continue that trend, and that 4% of some of the largest organizations turns out to not be a trivial number at all. Walmart? 2.3M employees. JPMorgan? 256k employees. I wrote recently that a single compromised user gives an attacker a foothold in your organization and is often the start of most major data breaches.

So now that we know some individuals are susceptible, let’s take a look at the brighter side of that number; almost 80% of all users never click on a single link at all.

Reporting Incidents

It’s not a huge secret that today vendors rely heavily on samples being reported in order to improve detection rates. What is pretty interesting is that a vast majority of phishing campaigns go unreported, with only 17% being reported at all. This means that you have no idea how effective you are at blocking those messages inbound and that there are plenty of instances where potentially malicious content has been viewed inside your organization and you have no idea.

Phishing_Reporting

Bringing it All Together

Now that we’ve got a little transparency into some raw numbers, let’s spend a minute on a more positive note and outline some great features available to help combat the knowledge gap in end users and the drastic increase in inbound phish attempts.

Microsoft’s Security Intelligence Report outlines the increase in phishing messages their service identifies. They handle over 470 billion messages per month and saw a 250% increase over the span of 2018.

Phishing_Rates

As phishing campaigns become more and more complex, so has the way service providers protect their end users from 0 day threats. Microsoft leverages the sender side signals of those 470 billion messages to develop a user first contact graph to leverage machine learning for impersonation protection. On top of that, ATP adds SafeLinks and Safe Attachment protection for Office. The technology proxies every single end user click through a Microsoft server to validate the target URL before directing the user there.  The cool thing about that statement? SafeLinks works in Office, including Office Mobile for your remote users. URLs embedded in attachments are equally protected.

Microsoft certainly isn’t the only provider who’s making great strides on the email front; vendors like ProofPoint, FireEye, Palo Alto, Menlo, etc. have all innovated in their own right as well. The thing that sets Microsoft apart is that they handle exponentially more mail than all other vendors and leverage machine learning and artificial intelligence to make use of that data to exponentially improve protection for their users.

Keep up the Good Fight

Unfortunately the world isn’t going to become a peaceful place overnight and people aren’t going to suddenly become benevolent to their neighbors. While I’ll keep waiting for that day to come and doing my part to see it to fruition, I’ll also work just as hard to stay on top of emerging trends to make the internet a safer place for everyone to learn, collaborate, and enjoy a bottomless sea of cat memes.

Big thanks to Cam and Daniel for sharing sources for data.

 

 

Securing Exchange Online

For those of you who weren’t lucky enough to attend, or simply didn’t know it was happening, Microsoft wrapped up Ignite last week and left us with plenty of savory info!

For most of 2018 I’ve been working with customers of all sizes and helping them to understand security in Office 365, namely in One Drive for Business and Exchange Online. Most customers are at least a little leery about placing critical workloads like Exchange and file storage in the cloud without understanding at least a little bit about how that information is secured. Well, Microsoft took a moment to outline a few simple configuration changes that will immediately improve your security stance in Exchange Online.

So to get this shindig kicked off, let’s take a look at the different stages of breach. When defending against threats it’s important to understand this as a killchain and defend as far to the ‘left’ in the killchain as possible and of course, throughout.

S_EXO_Attacker Killchain

Attackers will perform a discovery, or recon of your tenancy to understand more about your users. During this phase, they’ll try to determine more about your users and what they may be able to use to exploit them. This may be as simple as checking your company’s webpage or wikipedia to find out who senior management is in order to either target them or use their information to convince others.

After they’ve gathered enough information, they’ll try to use it to actually breach your organization. Things like password spray, brute force, and just good ole’ fashion fishing will be their tools of choice.

Once they’ve gained access, then the exciting stuff starts! They’ll first enumerate who your users are, including your admins and specifically target them. Not only that, they’ll do their best to make sure that they retain access to anyone they gain access to with things like inbox rules, mobile device enrollment, delegation, external sharing requests, etc. Finally, they’ll use common practices like eDiscovery, mailbox protocols, and external forwarding to grab your information and sell it to the highest bidder!

So how do you protect yourself? Again, focusing to the left in the killchain we’ll want to start with end user education. Educate your users around things like passwords and what kind of information they divulge in social media. Then we’ll do our best to combat the initial breach. Enforcing things like extranet lockout in ADFS, ensuring mail authentication (SPF, DKIM, and DMARC) are set up correctly, and limiting app framework in Azure.

To address elevation of privilege, we really want to focus on admin roles and impersonation. First, multifactor auth is an absolute requirement for administrators. That’s non-negotiable. Impersonation should only be used when absolutely necessary, and that’s pretty rare. Some third party apps require impersonation to work, but other than that, almost no one should be grated impersonation permissions. Since it doesn’t change too often, a pretty easy way to review it would be to imply set up an alert policy in Office 365 to alert an admin when impersonation has been granted. If it wasn’t you, then remove the access and start an account breach remediation  process on the person who granted it.

Next, we’ll want to address entrenchment. Attackers will do their damnedest to retain the access/information they have. First, look into Azure information protection. If your information leaves the organization but is encrypted, it’s much better than the alternative. Attackers will create inbox rules for end users to automatically forward messages or to hide responses or remove responses based on key words like ‘Helpdesk’, ‘phish’, ‘hack’, etc. Then they’ll forward mail outside of the organization that looks interesting to them. Allowing automatic forwarding outside of your organization needs to be disabled unless absolutely necessary.

Finally, they’ll use admin roles to export all the information they can. You need to make sure that you don’t grant discovery permissions to people who don’t need it. Then you need to alert on who exports that information and audit on what else that person did.

There’s a lot here, but start with some simple things. Enforce multifactor authentication for both admins, and all users. That will drastically reduce the risk to your end users. Next, disable legacy protocols like POP, IMAP, and SMTP Authenticated Send to ensure that attackers can’t bypass MFA and can’t use accounts they have access to, to phish your internal users. Finally, set up alerting policies for forwarding, elevation or privilege, and eDiscovery.

Don’t believe me? Watch the presentation from Ignite:

https://myignite.techcommunity.microsoft.com/sessions/65645#ignite-html-anchor