Picus Security has published The Blue Report 2024: State of Exposure Management, revealing that 40% of tested environments had attack paths leading to domain admin access. This level of access is alarming as it grants attackers control over an organization’s entire IT infrastructure, akin to handing them a master key. The report is based on a global analysis of over 136 million simulated cyber attacks conducted by the Picus Security Validation Platform.
The Security Domino Effect is Concerning
The Blue Report 2024 reveals that, on average, organizations prevent 7 out of 10 of attacks, but are still at risk of major cyber incidents because of gaps in threat exposure management that can permit attackers using automation to move laterally through enterprise networks. Of all attacks simulated, only 56% were logged by organizations’ detection tools, and only 12% triggered an alert.
“Like a cascade of falling dominoes that starts with a single push, small gaps in cybersecurity can lead to big breaches,” said Dr. Suleyman Ozarslan, Picus co-founder and VP of Picus Labs. “It’s clear that organizations are still experiencing challenges when it comes to threat exposure management and balancing priorities. Small gaps that lead to attackers obtaining domain admin access are not isolated incidents, they are widespread. Last year, the attack on MGM used domain admin privileges and super admin accounts. It stopped slot machines, shut down virtually all systems, and blocked a multi-billion-dollar company from doing business for days.”
Well over a third (40%) of environments have weaknesses that allow attackers with initial access to a network to achieve domain admin privileges. Once they have these privileges they can manage user accounts or modify security settings. A compromised domain admin account can lead to full control of the network, allowing attackers to conduct data exfiltration, deploy malware, or disrupt business operations.
macOS EDR Misconfigurations Lead to Vulnerabilities
The Blue Report 2024 also highlights that macOS endpoints are far more likely to be misconfigured or allowed to operate without Endpoint Detection and Response (EDR). macOS endpoints only prevented 23% of simulated attacks, compared to 62% and 65% for Windows and Linux. This highlights a potential gap in IT and security team skill sets and approach in securing macOS environments.
“While we have found Macs are less vulnerable to start, the reality today is that security teams are not putting adequate resources into securing macOS systems,” said Volkan Ertürk, Picus Security Co-Founder and CTO. “Our recent Blue Report research shows that security teams need to validate their macOS systems to surface configuration issues. Threat repositories, like the Picus Threat Library, are armed with the latest and most prominent macOS specific threats to help organizations streamline their validation and mitigation efforts.”
The Blue Report 2024 helps security teams benchmark their performance against peers and identify areas for improvement. Additional key findings include:
- Common language passwords: 25% of companies use passwords that are words commonly found in the dictionary. This means that it is easy for attackers to crack hashed passwords and obtain cleartext credentials.
- Organizations only prevent 9% of data exfiltration techniques used by attackers. Data exfiltration is used to steal sensitive data and is commonly used in ransomware attacks.
- BlackByte, the most challenging ransomware group for organizations to defend against, is prevented by just 17% of organizations, followed by BabLock (20%) and Hive (30%).
To download the Blue Report 2024, visit the website here.
Related News:
Picus Shows 40% of Companies Fail the Security and Attack Simulation
Cohesity Data Cloud Updates and GenAI Detection and Recovery
*Methodology:
The findings in this report are based on the results of simulated attack scenarios executed by Picus Security customers from January to June 2024. The data has been anonymized and aggregated from 136 million attack simulations. Research and analysis was completed by Picus Labs, the research team of Picus Security.
