2022 was a sobering year for us all. Riding on the back of the COVID pandemic of the previous two years, we entered a new reality with war returning to Europe in a way not seen since 1945. And yet along with tanks, missiles, and the targeting of civilians and civilian infrastructure came a new battlefront: cyber warfare with wipers being used to hit targets inside and outside the physical battleground.

Meanwhile, new attack surfaces came to the fore, as cybercriminals began to understand how to exploit identity for access and cloud workloads for assets, privilege escalation and lateral movement.

It’s not been all bad. Evolving security technologies like XDR are helping organizations to fill the gaps in visibility, join the dots in defense, and hunt for hidden threats in the enterprise. Law enforcement at home and abroad has been capturing and incarcerating more cybercriminals than ever before, while also closing the doors on some of the darknet’s worst illicit markets.

But defenders are still playing catch up, a point not lost on our experts who, below, offer their predictions for what we can expect in cybersecurity 2023. Our predictions last year weren’t far off the mark, so as we look forward to another year in the trenches of cybersecurity, here’s what our researchers and thought leaders see in their crystal balls.

Driving Painful Lessons Home

2022 has been a year of painful lessons precisely because the most intense threats weren’t technically advanced or mind-bending feats of cyber wizardry. Instead, they were mundane, pragmatic, and wildly successful. This year was largely populated by asymmetrical threat actors– hacktivists of all stripes, youthful petty criminals, and an increasingly fragmented ransomware ecosystem.

Infosec dark humor held that ransomware groups were ‘technical debt collectors’– attaching an eye watering price tag to unpatched systems, misconfigurations, and generally underserved networks. It seems that we collectively underestimated the true depth and breadth of that technical debt as a wider swath of lower tier threat actors show us the results of living on a diet of fruit so low-hanging as to have rotten on the pavement.

Cells of youthful SIM swappers and source code hoarders, best referred to as ‘disorganized crime’, have successfully hacked their way across scores of noteworthy well-resourced companies. They’ve embraced a pragmatic approach to operations– abusing the nebulous web of dubious ‘trusted’ parties that serve the customer-facing requirements of larger corporations. Whether through social engineering, stolen and borrowed credentials, or the financially-motivated shortrun insider, attackers have enjoyed all that excessive privileges across unsegmented service VPNs can net them.

The cumulative effect? A near endemic failure of SMS 2FA as a security measure. As we enter 2023, we need to accept that hardware multi-factor authentication, short lived sessions, and severely curtailed account privileges aren’t nice-to-have paranoid bells and whistles. They are now the entry threshold of the aspirational standard of corporate security.

The ransomware ecosystem continues to shift, experiment, and fracture. The most notable incident is the ‘Conti Rica’ affair, where a ransomware group held an entire government for ransom. In 2023, our tracking will have to become more granular– moving away from the notion of monolithic ransomware cartels to acknowledge the prevalence of smaller affiliate groups (often engaged with multiple RaaS brands).

Perhaps at that level of observability, we’ll be quicker to note attempts to use ransomware as a flimsy cover for nation-state activity– as in the case of Iran ‘ransoming’ Albanian governmental institutions. This last facet jives with the abuse of an increasingly populated field of hacktivists (of varying degrees of authenticity) emerging to represent different sides of hot conflicts and societal tensions via overrated DDoSes and underrated hack-and-leak ops whose long-term effects are entirely unforeseeable.

The cybersecurity industry enjoys cutting its teeth on advanced threats and sophisticated techniques that challenge the collective braintrust to find new solutions. But 2022 has forced us to pay attention to the state of disrepair of our networked fabric. Without a sizable, conscientious collective effort, we should brace ourselves for a 2023 that drives those painful lessons well beyond our tolerance.
Juan Andres Guerrero-Saade, Sr. Director of SentinelLabs

Cybersecurity Only Works When “It Just Works”

2022 has been a year where, compared to previous years, the cybersecurity market has adapted not just to the threat landscape but perhaps more strongly to how security teams want to use cyber-security products. This is something I expect to see much more of in 2023.

Consolidation, But Not At All Costs

The sheer number of cyber-security products covering different surfaces and use cases means that customers are looking to consolidate when and where possible. With that said, there are many sides to consolidation – security teams will not satisfied with just “buying more products from the same vendor vs multiple vendors” or “pushing everything to one data-lake” – they will demand holistic workflows, unified agents and cross-product synergies that actually deliver value that is greater than the sum of its parts when consolidating around a platform as opposed to endless point solutions.

Demand for More Vendor Collaboration

As much as we expect consolidation, customers will always end up using more than one vendor. We’re already seeing security teams demand more integration and more value from the collaborations between vendors. Gone are the days when a “technological alliance” could mean little more than a shared video. In 2023 this will range from a demand for integration across more types of use-cases and standardization of data models to a very legitimate expectation that every new vendor will not only provide value on its own but also help extract more value from the existing products in the security stack

Data Retention Needs to Be Simpler, More Affordable

Despite sounding like an oxymoron – it actually makes a lot of sense. There’s no argument about the importance of data. Between compliance regulations, low-and-slow attacks and the overall increase in analyst skill-level – most customers can and need to do more with security data.

The historical price and complexity of facilitating that is where change is going to come. SOCs will start looking for alternative solutions for Analytics and Data Storage that make more sense in terms of cost, scale, performance and ease-of-use. They’ll be looking for improvements across the board – from “How we get the data in” to “How we can access historical data”, “How fragmented the data will be” and ultimately “How much does it cost”.
Yonni Shelmerdine, VP Products, SentinelOne

No One Gets to Opt Out of Cybersecurity in 2023

If there is one thing that we learned from 2022, it is that no one is immune from cyber threats. We’ve seen many breaches in 2022 – Lapsus$ alone breached Okta, Nvidia, Samsung, Ubisoft, T-Mobile, Microsoft, and Uber. It’s hard to believe that behind these breaches, there were no well-sponsored nation-states or global cybercrime syndicates but (allegedly) a group of young hackers who met online and collaborated, not even financially motivated.

This creates a new paradigm to think about. I am not a fan of zero trust, as it is tough for organizations to implement and leaves cracks for adversaries to exploit, but trusting no one makes more sense when you look at 2022. So what should we expect in 2023? There are a few moving parts to consider.

Cost Will Be a Driving Force

The economic turmoil will pressure enterprises and organizations to save on costs and be more effective. As a result, expect more consolidation of pinpoint tools and teams and more utilization of growth and efficacy enablers like moving to the cloud.

Prediction: With less security budget, efficiency-driven products will strive. The cost will become the main consideration for cybersecurity programs.

Attacks Will Be Bigger, Louder, Faster

The attacks we’ve seen in 2022 are more significant than those we witnessed in 2021. This is not just a trend; the reasons remain: Vulnerable products (led by Microsoft as an operating system provider and a security vendor), the means of communication, and the speed it takes a zero-day to become an exploit.

Prediction: More organizations will be breached, more critical infrastructure will be impacted, and the cybercrime economy will continue to thrive.

We Are Entering A Golden Era of Social Engineering

As we’ve seen in the Cisco breach, it’s enough to compromise a user to gain access to the entire network. With social networks, multi-tasking, and the evolution of devices around us, it just makes sense for adversaries to keep investing in social engineering.

Prediction: Phishing is a problem that is not solved and will continue to be a leading factor in compromising identities.
Migo Kedem, VP Growth, SentinelOne

The Disruptors Are Here, And They Aren’t Going Away

2022 has been the year of disruption by non-traditional threat actors. Flaws in how teenagers exploited the way the traditional cybersecurity establishment thinks. Advances in computing power and AI will transform the effectiveness of social engineering, fraud, and active measures (information/influence operations). As governments try to get a handle on asymmetric threats, new ways of attacking the global problem will have to be used.

Deep Fakes Will Enhance Social Engineering

As we get better at defending the endpoints, threat actors will need to up their game in order to penetrate harder targets. Social engineering remains a popular vector of attack, especially as workforces continue to remain decentralized and remote. Increases in computing power and availability of AI/ML engines will accelerate the effectiveness and authenticity of social engineering attacks through audio and video.

Increased Targeting of Vaccine R&D by China

The unthinkable has happened in China–widespread dissent that is becoming more vocal and violent. Aggressive lockdowns have not made the expected impact in the spread of COVID, and the Chinese vaccines are significantly less effective than international options. For President XI Jinping, an attractive option is to enhance the efficacy of their vaccines through more aggressive theft of R&D and medical intellectual property.

Lapsu$ Shows Flaws in Adult Thinking

Migo Kedem laid out the impact of Lapsu$ and the disruption they caused. This was a group of 16-21 year olds who out thought and outwitted some of the most sophisticated cybersecurity defenses and professionals in the world. How? Because it doesn’t matter how we look at the problem. It only matters how our adversaries look at the problem. Expect more attacks and disruption by younger threat actors who refuse to limit their thinking to the proverbial way of doing business.

Retasking of Intelligence Priorities

According to testimony before Congress during hearings on the SolarWinds compromise, it was estimated at last one thousand engineers and intelligence officers were involved in the design and execution of the operation. And yet there is no evidence any intelligence agency outside of Russia was able to discover this long-term campaign.

This is a glaring failure of intelligence that has become increasingly technically focused. To stop major intelligence operations, we have to develop robust HUMINT – human intelligence. And that can only come from more aggressive recruitment of agents in targeted sections of adversarial intelligence organizations. There will be retasking of intelligence priorities to identify earlier, and disrupt more aggressively, long-term operations against nations and critical infrastructure.
Morgan Wright, Chief Security Advisor, SentinelOne

No More Hiding Behind Our Macs

Indicators of what we might expect in 2023 can be read in the tea leaves of our roundup of macOS threats in 2022. The year just ending saw something rare in the macOs threat landscape become common: the inclusion of Mac payloads appearing in numerous cross-platform attack frameworks. While this wasn’t entirely unheard of in the past, it was not the norm, and Mac payloads were generally poorly written, unreliable and, frankly, unsuccessful.

What’s changed is the increasing popularity of two things: performative and stable cross-platform languages like Go, Kotlin and Rust, and Mac devices in the enterprise. The first makes it easier for threat actors to write Mac-compatible malware, the second gives them the motivation to get better at it.

Another trend that gathered pace in 2022 was the number of reported CVEs for macOS devices, many of which allow privilege escalation and some the ability to execute kernel code from user land processes. While a transparent bug reporting ecosystem is a good thing and long overdue regarding Apple operating systems, it has consequences for those that patch little, and patch late.

Threat actors, with or without the help of security researcher write-ups and PoCs, will increasingly pay attention to exploiting reported bugs (aka N-days) on enterprise users that fail to patch. It’s not for nothing that Apple has become more aggressive in trying to force enterprises to update within 90 days.

In 2023, expect to see threat actors target macOS more successfully with cross-platform malware and to expend more effort on finding windows of opportunity to compromise unpatched Macs with known bugs. More supply chain attacks on developers and shared repositories are also likely to feature in 2023.

Deploying a native Mac security solution is the default first step to combating the increased attention of threat actors on high-interest targets like developers and senior management in 2023. Enterprises that defer upgrades and minor updates need to pay particular attention to risk assessment and their overall macOS security posture.
Phil Stokes, macOS Threat Researcher, SentinelLabs

Conclusion

Threat actors have become collaborative enough and malicious software and techniques available enough to brings us to a point where attackers are now platform and technology agnostic. Where there is a weakness, there is a way.

And yet, while 2023 will undoubtedly hold surprises none of us could predict, it’s a fair bet that organizations that cover their bases, kill off the low-hanging fruit, and implement coverage across cloud, identity and endpoint will be safer than those that do not. The future is opaque to us all, but in cybersecurity we can’t afford to trust to luck.

Welcome to Part 4 of our multi-part XDR (eXtended Detection and Response) blog series. If you haven’t read the earlier posts in this series yet, we recommend checking out the following:

• Part 1 discusses why organizations need to extend protection beyond the endpoint to stay ahead of adversaries
• Part 2 discusses why Endpoint Detection and Response (EDR) is a foundation and a cornerstone for any XDR strategy.
• Part 3 discusses why identity security is a cornerstone of an XDR strategy

In this post, we discuss the importance and value of security data for detection and investigation.

Challenges With Security Data Visibility

In today’s landscape of increasingly sophisticated cyber threats, organizations must be able to effectively operationalize the data housed in their cybersecurity tools to maintain visibility across their networks.

However, many organizations struggle with this due to the cybersecurity tool sprawl and point products, which do not integrate well, leading to inefficiencies in visibility, detection, investigation, and hunting. An ESG study found that 66% of customers surveyed admit that “if you keep your data in multiple silos, you’re guaranteed to lack visibility and miss critical detections.”

As a result, many organizations lack the visibility they need to defend against cyber attacks. Cross-stack visibility of security data is a cornerstone of any effective cyber defense strategy, and organizations that can’t achieve it are at a disadvantage. To address this issue, organizations must focus on consolidating their tools and integrating their data, enabling teams to operationalize their tools more effectively and gain the visibility they need to protect their information assets.

Why Legacy Tools Have Failed

SIEMs have been on the market for over a decade now, and they are still failing to meet the needs of organizations when it comes to detection and response. The problem is that SIEMs are designed to be reactive, not proactive. They rely on SOC teams to manually sift through data and look for patterns of malicious activity –  a time-consuming and error-prone process that often leads to false positives or late detections. Additionally, SIEMs have very little automation, so they cannot keep up with the rapidly changing landscape of cybersecurity threats.

The security information and event management (SIEM) model is aimed to be the one-stop shop universal answer to reducing mean time to detect and respond. However, SIEM with its reliance on indexed architectures and on-premises infrastructure, is not a panacea.

Indexed architectures, while suitable for performing simple queries, struggle to keep up with the increasing volume and complexity of security logs. As a result, they often require lengthy search times and may not provide complete coverage of log types. On-premises infrastructure also brings with it concerns regarding scalability, as well as the need for physical space and maintenance resources.

The limitations of these traditional models have led many organizations to embrace modern cloud-native logging solutions. These options offer increased flexibility and scalability, allowing for rapid expansion during times of growth or additional monitoring needs. They also eliminate the need for physical hardware and maintenance costs, resulting in cost savings for the organization.

A major issue plaguing SIEMs is that they simply ingest alerts without any context among the atomic data points. For example, a single alert or threat may comprise thousands of pieces of telemetry. When looking at only alerts, analysts can be blind to additional activity and indicators that may be linked to a larger scope of malicious activity. While this approach may be suitable for high-level monitoring or compliance, telemetry is far superior to enable security teams to threat hunt and perform analytics effectively.

Telemetry includes data such as raw network flows, endpoint, and cloud activity that can provide context to the alerts being generated and give analysts the ability to quickly determine whether an alert warrants further investigation. Additionally, analysts can use this extra data to detect sophisticated attacks that may appear benign in isolation. However, feeding this essential security data into a SIEM for analytics can be prohibitively expensive, particularly for small and medium-sized businesses.

For SIEM deployments, time to value can often be a struggle. The implementation process may involve collecting and normalizing data from multiple sources, setting up alerts and dashboards, and fine-tuning configurations. This can stretch the deployment timeline and delay the realization of benefits such as improved visibility into network activity and threat detection.

According to the Panther.io State of SIEM 2021, over 18 percent of the IT security professionals surveyed indicated that the time it took to receive high-value alerts — from deployment to implementation — was 12 months or longer. Additionally, over 40 percent said their organization was overpaying for their SIEM relative to the system’s capabilities.

Unifying Security Data with XDR

To create human-understandable context among the alerts and logs flowing into traditional SIEM, most organizations build rules, dashboards, and playbooks on top of alert data. However, this approach needs more visibility into the underlying endpoint devices or cloud workloads. Looking only at summary-level data in a SIEM can make it difficult to centralize triage and investigation, making it more likely that threats will go undetected.

Collecting and storing this data is only half the battle – the real challenge lies in making sense of it all. EDR vendors have recognized this problem and are increasingly offering powerful cloud-native logging and analytics tools to ingest and analyze security and IT telemetry. This is where correlation comes in.

By looking at how different data sets relate to one another, analysts can uncover patterns and trends that would otherwise be hidden. For example, by correlating network traffic data with employee login records, it may be possible to detect unusual activity that could indicate a security breach. By simplifying access to relevant data sets like logs and indicators of compromise from other tools, security teams can gain a complete view of their organization’s security posture.

As the amount of data generated by enterprise infrastructure continues to grow, many security vendors are turning to artificial intelligence (AI) to help make sense of it. AI can be used to detect suspicious and malicious behaviors, and it can also help to identify anomalous activity that might otherwise go unnoticed.

Endpoint Detection and Response (EDR) vendors have expertise in developing behavioral AI models and performing large-scale analytics on telemetry sourced from native endpoint agents. It’s only natural that Extended Detection and Response (XDR) is an evolution of EDR that brings the same visibility, analytics, and response to any attack surface.

XDR solutions extend the core EDR platform, providing visibility into native endpoint, cloud, network, and identity telemetry and making it easier to detect and respond to threats in real time. This approach is more economical and can provide better visibility into potential threats because they can operationalize consolidated telemetry in a single console without needing to export the data to a SIEM for analysis.

XDR platforms powered by machine learning, like SentinelOne Singularity, produce correlated alerts that provide the precise context analysts need to make informed decisions, saving valuable time during endpoint triage and response. AI and automation, such as Singularity Storyline, remove the heavy lifting of data analysis and bring high-fidelity signals through the noise.

SentinelOne patented Storyline technology provides real-time, automated machine-built context and correlation across the enterprise security stack to transform disconnected data into rich stories and lets security analysts understand what happened in their environment. Storyline automatically links all related events and activities together in a storyline with a unique identifier. High-fidelity alerts allow security teams to see the full context of what occurred within seconds rather than spending hours, days, or weeks correlating logs and linking events manually.

Singularity XDR provides a single, unified platform for extended threat detection, investigation, response, and hunting with:

• Single source of prioritized alerts that ingests and contextualizes massive quantities of data across multiple native EDR data sources.
• Direct integration with other best-of-breed platforms like Zscaler, Okta, and Mimecast for the purpose of automatically enriching alerts
• Single consolidated view to quickly understand the progression of attacks across security layers.
• Single platform to rapidly respond and proactively hunt for threats

Conclusion

If you want to improve your organization’s current XDR strategy, you should focus on utilizing your organization’s security data. By doing so, you can more accurately detect and respond to threats. A modern XDR solution will integrate this data to give you a comprehensive view of your organization’s security posture. Request a demo today to see how our platform can help you implement an effective XDR strategy.

It’s no secret that social engineering is a powerful tool in a cybercriminal’s arsenal. Threat actors use psychological manipulation to convince unsuspecting users to hand over their passwords, personal information, or money. To date, social engineering attacks have served as the most common tool to gain initial foothold and perform lateral movement in the network.

In this post, we discuss the dangers of social engineering and how to combat them. We cover common social engineering techniques used by cybercriminals, uncover real-world social engineering-based attack paths, and explain what organizations can do to decrease the risk.

Prominent Types of Social Engineering Attack Techniques

There are several social engineering attack techniques. However, those who are the most frequently seen as part of cyber-attacks that target enterprises are:

Phishing

One common social engineering technique is phishing. This is where cybercriminals send out emails that appear to be from a legitimate source, such as a bank or an online retailer.

Be very cautious of the email on a Friday evening at 4 PM, when you are about to leave for the weekend, from your e-commerce company asking you to click on the link to process your refund, to check some unusual activity or open some attachment. Other good examples of common phishing tricks can be found here.

The email may contain a link that leads to a fake website that looks identical to the real one. Once the user enters their login details, the cybercriminal can access their account.

Real-World Attack Example

In May 2021, with the ransomware attack on the Colonial Pipeline, millions of Americans experienced first-hand the impact of cyber attacks. During that cyber attack, the company was forced to stop all operations after its network got compromised. Cybercriminals were able to breach Colonial Pipeline through a targeted phishing campaign that gave them access to an employee’s user credentials which allowed them to start their ransomware attack from within the enterprise network.

Baiting

Another social engineering technique is baiting. This is where the cybercriminal leaves a USB drive or other types of storage devices in a public place, such as a parking lot. When someone finds the device and plugs it into their computer, the device will trigger specific actions targeted at the organization systems, infecting them with malware that eventually will lead to allowing attackers to gain access, or simply launch a destructive attack

Real-World Attack Example

The Federal Bureau of Investigation (FBI) recently warned that cybercriminals are performing so-called ‘BadUSB’ attacks. Malicious USB thumb drives are sent through the United States Postal Service and United Parcel Service, impersonating the US Department of Health and Human Services, claiming to be COVID-19 infection warnings.

Whaling / Business Email Compromise (BEC)

Phishing attacks that are targeted to high profile employees in an organization such as C-suite, VP, etc, is known as Whaling. Business email compromise (BEC), on the other hand, looks to impersonalize company executives to trick a normal user into performing certain activities. Both whaling and BEC require planning and study of the normal behavioral patterns and potentially result in much higher value outcomes.

Social engineering can also take place over the phone. This is known as vishing. The caller pretends to be a legitimate executive of an organization (BEC) and tries to trick the user into revealing sensitive information, such as credit card numbers or social security numbers.

Real-World Attack Example

A Chief Executive Officer (CEO) of a UK-based organization received a phone call from someone who sounded just like the CEO of the parent company, whereas the cybercriminal asked the victim to transfer $243,000 to a supplier. This was possible as the cybercriminal leveraged Artificial Intelligence to mimic the chief executive’s voice. With that in mind, it’s clear that vishing has evolved, and it’s no longer just the random scam calls that defenders must consider a threat.

Protection Against Social Engineering

As with anything with cyber security, it is always a fine balance between people, processes, and technology. Social engineering is the art of psychological manipulation.

Most victims fall prey to social engineering attacks unmindfully without having any malafide intentions. However, social engineering attacks are evolving to lure people into mindfully clicking on certain links or sharing confidential information.

As such, organizations must start with the people aspect and build a security-aware culture by investing in end-user cyber awareness. Naturally, as organizations build a formal end-user awareness program, the next center of focus will be on processes. Employees must know how to report social engineering attacks to the security teams.

Security teams need technologies that help them protect, detect, and respond to these attack techniques, which often span across email, identity, and the endpoint. In practice, all this is achieved through a comprehensive cyber security program that acknowledges the risk associated with social engineering.

Defense Begins with Awareness and Training

When an employee receives an email that looks suspicious, it is imperative to train them to recognize such emails and not to click on links or open attachments but instead report it to the security team.

Staff should be made aware of threat actor tactics such as calls that impersonate a supplier, colleague, or manager and ask for personal information or organizational details. Training employees to understand how to identify a potential phishing attack and how to report it can prevent a serious compromise.

Similarly, unidentified USB drives lying around in public places, in the corporate parking lot and elsewhere have been used in real-world and simulated attacks. Ensure employees understand they shouldn’t plug unknown devices into their endpoints, and instead turn them over to the IT or Security team. Device control can also help mitigate this kind of behavior.

These proactive measures help in building the foundational resilience against phishing attacks. However, this should be taken a level higher by imbibing the sense of responsibility among the employees by empowering them and letting them use cyber judgment. Helping them understand and implement ‘If you see something, say something’ to be the eyes and ears on-ground and they are equally important for securing the organization & its mission.

Empower Users with Clarity and the Confidence to Report Suspicious Activity

Organizations should have policies and procedures in place for dealing with suspicious emails, phone calls, and other communications. Providing employees with a simple, clear process for reporting social engineering attempts so that they can be investigated and stopped before any damage is done is a fundamental to enterprise security.

Cybersecurity teams should give clear and uncomplicated instructions to prevent any delay or unwillingness to report suspicous activity, and a firm When in doubt, Stop and Report It’ message should be communicated frequently to staff. Give assurance to the employees that they won’t be penalized for a delay in action or for reporting something they find suspicous, even if it may be determined as non-malicious later. Fostering the cyber empowerment culture is hugely important.

Testing the resilience against phishing attacks is equally important; hence, it is important to conduct phishing simulation exercises to assess the level of readiness in the organization. Phishing simulations are a useful assessment tool to evaluate employee’s resilience against phishing emails, but the same tool won’t be effective for intentional clicks by employees.

Simulation tests should only be done after you have attained a certain level of maturity in imparting cyber training and awareness among the employees and simulation isn’t used to name and shame the employees who may fail the test. The test should be followed by a training to close the loop.

Leverage Technology To Counter Social Engineering

From a technology perspective, there are several security controls that organizations can evaluate that will reduce the risk of social engineering-based attacks:

1. Multi-Factor-Authentication (MFA): Although MFA bypass methods exist as manipulating an employee to share their one-time password, implementing MFA can reduce the threat of social engineering-based attacks.
2. Additional Authentication: In case of business email compromise attacks (BEC) where a high-level executive is being impersonated, double checking using an offline method such as a voice call in response to an email marking the urgency should be done before initiating the action. For this method to be successful, the executives must be receptive and welcoming to double-checking/authentication.
3. Conditional Access (CA): By implementing CA, organizations can ensure that only trusted identities on healthy endpoints can gain temporary access to corporate resources and services as required, instead of default access to all corporate resources without any previous condition check
4. Identity Risk Assessment (AD Assessment): With the user’s identity often being center stage in an attack, having the ability to uncover security misconfiguration in real-time, the risk level of identities and performing remediation action is critical.
5. Identity Threat Detection and Response (ITDR): As identity-based attacks continue to increase, organizations are looking for ways to detect and respond to these types of attacks, and with that, ITDR technology is important.
6. Endpoint Detection and Response (EDR): As the majority of cyber-attacks are happening on the endpoint, and this remains true even in the context of social engineering, having the ability to detect and automatically or with a 1-click response to these threats is critical and with that EDR technology is also essential.

Conclusion

Social engineering is a serious threat to consumers and enterprises worldwide. By increasing our awareness of these attacks, having robust procedures in place, and the right tools, as defenders, we have the opportunity to reduce the exposure risk to these attacks significantly.