Quarterly Insights from Cisco Talos Incident Response
Cisco Talos Incident Response compiles a quarterly overview detailing prominent trends observed through their casework. The patterns in attacks, techniques, and methodologies identified by Talos play a vital role in enhancing the protective measures that Cisco clients rely on daily. This initiative underscores Talos’ commitment to the philosophy of seeing problems once and blocking them everywhere.
Major Findings from This Quarter’s Report
The recent report highlighted several crucial insights regarding cybersecurity threats:
Valid Accounts on the Rise
Starting in December 2024, there has been a noted increase in password-spraying incidents aimed at accessing systems via legitimate accounts. Such unauthorized access can severely disrupt operations by locking out authorized users. Alarmingly, among all ransomware cases reported, none of the compromised accounts utilized multi-factor authentication (MFA), or if they did, it was circumvented during the attack.
Initial Access Trends
The primary source of initial access—identified when possible—was through vulnerabilities within public-facing applications, accounting for 40% of engagements; this marks a significant shift as it surpassed valid account exploitation for the first time in over a year.
Dwell Times Significantly Increase
A troubling trend reveals that attackers are lingering within systems for durations ranging from 17 to 44 days prior to deploying ransomware. Such extended dwell times allow them greater access to sensitive information and amplify their impact on organizations. Lengthy periods inside networks may indicate that adversaries are working diligently to broaden their attack vectors while evading detection mechanisms.
Escalation Through Remote Tools
Upon gaining entry into networks, attackers have increasingly utilized remote access tools—increasing from 13% last quarter to an alarming 100% this quarter—for lateral movements within organizations.
The Rise of Data Extortion Tactics
This quarter also saw an uptick in data theft extortion strategies targeting individuals at high risk should sensitive information become public knowledge. New methodologies and instruments available to online criminals have significantly augmented their capabilities for gaining remote accesses.
The Call for Comprehensive User Protection Strategies
Talos’ latest incident response findings stress the importance of multilayered user security coupled with robust detection and response solutions across diverse technologies and infrastructures. At Cisco, we offer both the User Protection Suite—a proactive defense mechanism—and Breach Protection Suite—which provides extensive visibility across multiple products aimed at thwarting these emerging cyber threats effectively observed by Talos.
MFA Considerations: Ensuring Strong Authentication Practices!
Implementing multi-factor authentication across your organization is paramount not just as a standard practice but ensuring its robustness against potential bypass attempts is equally crucial. The Duo technology within our User Protection Suite offers extensive MFA coverage designed for all user types—including contractors—and various applications ranging from contemporary platforms to legacy systems susceptible due to outdated security protocols like Remote Desktop Protocol (RDP).
Simplicity with MFA is commendable; however, sophistication matters just as much! By employing Risk-Based Authentication via Duo’s platform allows prompt identification during unusual login activities resulting in real-time escalations towards more secure forms such as Verified Duo Push demanding additional codes—it adds another layer between bad actors and your organization’s integrity!
