ALT While the whole world combats the covid-19 pandemic side-by-side, cybercriminals have decided to gather their efforts to attack healthcare in force, because all they care about is money. IBM security published its 15th annual Data Breach Report based on research conducted by the Ponemon Institute, offering a point-in-time assessment of data breach costs and contributing factors. The report shows that the cost of a breach in 2020 is $3.86M while the time to identify and contain a breach was 280 days. The report surveyed companies including: Healthcare, Financial, Energy, Pharmaceuticals And healthcare is at the top of the list of the industries target by cybercriminals In the healthcare industry, the average cost of a data breach in 2020 was $7.13 million with a period of 329 days to identify and contain the breach. The energy industry comes in second with an average cost of $6.39M with 254 days to identify and contain a breach. 2020 with all its catastrophic realities is over.

ALT Adversaries sometimes use valid accounts to gain remote connections into a #network they are targeting, such as telnet, SSH, and VNC. They usually use techniques such as ssh brute-forcing or exploit the OpenSSH User Enumeration Timing Attack to get valid #credentials. The #adversary may then perform actions, acting as the logged-on user. This can be hard to detect because such actions can’t be immediately flagged as #malicious. In an enterprise environment, servers and workstations can be organized into domains. Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network. If an adversary is able to obtain a set of valid domain credentials, they could log in to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP). Also, #Intruders can deploy techniques such as ssh pivoting to expand through different networks.

ALT There’s a strong relationship between Active Directory and Lateral movement. In a previous blog post, we defined lateral movement (sometimes called east-west movement) as the techniques that adversaries use to expand their presence in a network by establishing control first over one asset and then over many more until they reach their objective. Okay, but what are these assets? Here comes Active Directory. Active Directory is one of lateral movement’s most fought over battlefields where intruders move from one machine (asset) to another. All machines are part of what is known as Active Directory’s Trees and Forests. Intruders often use some of the techniques listed in the previous post to get credentials and escalate privileges. Active Directory is known for its massive attack surface and methods. While old methods are still in use, every year new methods are introduced. For example, the ZeroLogon attack that went public in August.