Ophthalmologist near Cross, SC

Network Security, Email securityMike Britton May 8, 2024

Today’s columnist, Mike Britton of Abnormal Security, writes that account takeover has become more of a threat to security organizations than ransomware or phishing. (Adobe Stock)

Email continues on as the biggest threat vector organizations face today, offering cybercriminals a broad attack surface to target for phishing, fraud, and social engineering schemes, as well as what’s arguably the most dangerous type of email attack: account takeover.

A compromised account can open up a number of risks: from exposing sensitive company or customer data, creating a launchpad for additional attacks or fraudulent transactions, and letting hackers move laterally across additional applications and connected platforms. The downstream impact of these attacks are often devastating, not only incurring disruption to the business, but also potentially leading to significant financial loss or a jeopardized customer experience.

Security leaders are waking up to this threat. Some of our recent research shows that nearly 70% of security leaders view account takeover attacks as the greatest concern to their organizations—even ahead of news headlining threats like ransomware and phishing. Unfortunately, their concerns are valid. Eighty-three percent of these security leaders reported that their organization had been directly impacted by an account takeover attack within the past year, and nearly one-fifth have been impacted more than 10 times.

The dangers of cross-platform account takeover

For many security stakeholders, the phrase “account takeover” usually brings to mind a compromised email account, but these attacks are no longer limited to just the inbox. Today’s cloud application ecosystems are increasingly broad, interdependent, and complex. And as these apps proliferate, they create additional points of entry, each with their own distinct risks if compromised. For example:

Compromised accounts have been the culprit behind several well-known breaches in recent years. A single compromised password reportedly resulted in the Colonial Pipeline ransomware attack, where attackers gained access to the corporate network through an inactive VPN account. The login credentials belonging to the employee who owned the account were likely reused from another website that was previously compromised.

Electronic Arts also experienced a damaging account compromise, leading to a breach that resulted in the loss of highly valuable intellectual property, including the source code for FIFA 21. This attack began when attackers gained access to an internal Slack channel using stolen session cookies. Once inside Slack, the attackers messaged IT support, asking for a multi-factor authentication token that they claimed they needed because of a lost mobile device. With this token, they could infiltrate the corporate network, and then download data and source code.

These are just a couple of the most infamous account takeover examples, but it’s not just major brands that are at risk. Any company that uses cloud-based applications—whether for email, collaboration, identity, or cloud infrastructure—is under threat.

The challenge of detecting cross-platform account takeover

There are two characteristics about cross-platform account takeover attacks that make them difficult to detect.

First, there’s a visibility challenge. It’s one thing to monitor for suspicious activity across the cloud email environment; scaling this across dozens of other apps becomes exponentially more challenging. Maintaining centralized visibility and unified control across diverse collections of cloud services has become especially difficult when different business units are individually responsible for their own apps.

Second, stolen credentials are the precursor to most account compromises, and obtaining those credentials usually takes exploiting a vulnerability that’s notoriously difficult to protect: people. Cybercriminals know that tired, distracted, or careless employees are bound to make mistakes, making them the perfect targets for social engineering attacks that let threat actors phish their account credentials.

The proliferation of generative AI tools over the last year has only made this problem worse, by giving threat actors a tool for creating more authentic-looking phishing emails, faster—greatly improving their ability to harvest credentials and initiate account takeovers.

Proactive protection strategies

There are a number of strategies that organizations are using to mitigate account compromise, including multi-factor authentication (MFA) and encouraging strong password use or implementing secure sign-on (SSO). And while these are important layers of defense that can decrease the risk of account compromise, they won’t eliminate it entirely, and teams shouldn’t treated them as a silver bullet.

We have to remember that today’s criminals are savvy, and can often find ways around standard controls. MFA bypass attacks, for example, have been growing in frequency, with some threat groups now selling MFA bypass-as-a-service kits on the dark web, providing stolen MFA tokens that make it possible to hijack active authentication sessions. MFA bypass has played a role in several high-profile attacks including the SolarWinds breach.

And while SSO can make security monitoring easier by offering a single source of log data and events, plus the convenience of enforcing strong passwords and MFA from one place, this simplicity also represents a downside. Once compromised, attackers can exploit that same ease and accessibility to move laterally across the network.

So what else can security teams do to supplement these measures?

Improving integration among current security tools can create complete visibility across the cloud ecosystem. Account takeover attacks often feature lateral movement across platforms—teams need the ability to see, correlate, and analyze the multiple behavioral signals across these different applications and platforms. By comparing these signals to baseline levels of user behavior and identifying deviations, organizations can improve their ability to detect potential account compromises rapidly and with confidence.

Cloud application ecosystems will only continue to grow, which means account takeovers will likely continue on as a popular attack tactic for threat actors. Ensuring the strongest protection possible against these attacks will require security teams to look at extending their visibility and control beyond email, with a particular focus on protecting their greatest vulnerability: human behavior.

Mike Britton, chief information security officer, Abnormal Security

Mike Britton

Mike Britton, chief information security officer at Abnormal Security, leads the company’s information security and privacy programs. Mike builds and maintains Abnormal Security’s customer trust program, performing vendor risk analysis, and protecting the workforce with proactive monitoring of the multi-cloud infrastructure. Mike brings 25 years of information security, privacy, compliance, and IT experience from multiple Fortune 500 global companies.

LinkedIn: https://www.linkedin.com/in/mrbritton/

Diane Imken and Ashley Baxter of Summerville, SC, are an inspiring mother-daughter volunteer duo with the American Red Cross of South Carolina. Together, they are blood donor ambassadors and Disaster Action Team (DAT) volunteers, helping families impacted by disasters in the Lowcountry Chapter.

May 10, 2024

Story told by Cheary Shelim, Red Cross Volunteer

Every year, the American Red Cross responds to an average of 65,000 disasters; most of which are local disasters like home fires. As trained DAT volunteers, Ashley and Diane provide relief to families by giving blankets, comfort kits with personal hygiene items, and sometimes, stuffed animals to children. They are also trained to help in Red Cross shelters, where people can have a safe place to stay, a hot meal, and access to additional support.

As blood donor ambassadors, they ensure that donors have a positive experience during blood drives. This is crucial because the Red Cross provides nearly 40 percent of the nation’s blood supply. The blood is used for accident and burn victims, surgery patients, organ transplant patients, and those receiving treatment for cancer and sickle cell disease. In 2023, the South Carolina region collected nearly 70,000 units of lifesaving blood.

Ashley credits her mother, Diane, for instilling a sense of volunteerism in her at a young age. “She volunteers more than I do. My mom did Meals on Wheels when I was a kid. She volunteered at the animal shelter, cleaning out cages and walking dogs. There’s probably more that she did,” Ashley muses.

Diane, on the other hand, says it was her daughter who recruited her to join the Red Cross. She’s proud that Ashley has helped so many people, and she loves the time she spends with her daughter when they volunteer on the same call. “Sometimes, [Ashley] will respond to something that is out of town. It takes a while to get there. So she’ll just swing by and pick me up. We go together and it works out real well. It gives us an excuse to go somewhere together and hang out for a while.”

Ashley shares about how her mother is excited to be a part of the Red Cross. “She’s really good about putting her Red Cross volunteer shirt when we go out for a call. She has her little backpack with all her stuff in it. She’s more organized than I am.”

“I’m just very happy,” Diane agrees, sharing how she appreciates working with the people at Red Cross. “You don’t get a monetary reward or anything for doing it. And it takes time out of your day. But everybody that I have dealt with has just been super personalities – very empathetic. We just want to make the clients as comfortable as we can make them feel, given the circumstances.”

Like Ashley and Diane, you can serve the community with your family too. Learn more about how you can help here: redcross.org/volunteer

Fran Marchette, from Florence, SC, is a volunteer with the South Carolina Region Disaster Services Team. She recently joined a disaster responder on a home fire call and renewed her commitment to giving back to her community through the Red Cross.

Story told by Nick Gibson

“I have sort of toyed with it. I hate to say I’m 68 years old, but I figured, ‘Well, how could I contribute the most?’” said Fran Marchette from Florence, SC, on how she decided to sign up as an American Red Cross Volunteer.

Fran recently moved to South Carolina after her husband passed away. She signed up to volunteer with the Red Cross Disaster Services Team and now helps to dispatch response volunteers to assist local families impacted by disasters.

“My husband was a career military officer, so we always gave back to the community and within the military community a lot. Since he has passed, I’ve been trying to find things to fill my time,” said Fran.

Red Cross Eastern South Carolina Chapter Executive Director Michael Hesbach presented Fran with a great opportunity. Michael invited her to train to become a Regional Disaster Duty Officer. Later, Michael encouraged Fran to respond to a local home fire during her training. She describes the experience as eye-opening, witnessing a home that was completely destroyed and displaced a family.

“The firefighters were still putting out the smoldering fire. It was basically out, but they were trying to make sure it didn’t reignite,” said Fran. “You could tell that the family is going to have a long road to recovery because they lost everything.”

Volunteers like Fran are trained in Psychological First Aid and many other essential skills to help comfort families in the immediate aftermath of a devastating event, like a home fire.

“The big thing with people who’ve had traumatic experiences is to listen to their stories and be as consoling as you can,” said Fran. “I feel that a lot of people don’t realize that there are a lot of things that they can do for the Red Cross, and it doesn’t take a lot of time to help their community.”

Fran encourages others to join the Red Cross as a volunteer and says there is a position in the organization to fit every skill set and interest. Learn more about the Red Cross Disaster Action Team at redcross.org/DAT

In honor of National Nurses Week, get to know a volunteer nurse serving our humanitarian mission

By: Kathy Stewart, Red Cross Volunteer

National Nurses Week makes a fitting time to meet and celebrate Carolyn Jacobs, one of more than 11,000 nurses and other health professionals who volunteer with the American Red Cross.

Carolyn spent 35 years as a Clinical Trials Coordinator including ICU, liver and kidney transplants before retiring in 2019. Soon after, Carolyn realized that she needed to do something with her extra time, and “the American Red Cross fit the bill.”

She jumped right in as a volunteer, simultaneously working roles as both a blood donor ambassador and also as a transportation specialist, in addition to working with Disaster Health Services.

Carolyn knows firsthand how important blood donations are for patients after her long career as a nurse. “We gave blood and platelets all the time. Sometimes the amount of blood that was available would go down and we would be at kind of a scary point when we realized that we’d need to start up more blood drives to get the folks in there to donate.”

She also understands that blood donation is a constant need, laughing as she noted that “I couldn’t always donate because my hematocrit level was too low. Now it’s good so I need to get in and donate myself! I’m an A-positive!” As the Lowcountry Coordinator, covering nine counties in the Lowcountry area of SC, Carolyn mentors new trainees who come on board at the Charleston, SC chapter and also coordinates the nursing staff who cover the shelters in the event of a disaster.

Carolyn and the volunteer teams are a crucial part of making sure that families get what they need quickly after local smaller disasters, such as home fires. “We take turns being on call and as soon as we receive contact information, we reach out and let them know that we’re nurses with the Red Cross. We help them discover any medical items they may have lost in the fire, like medical equipment, medications or prescription glasses. We’re authorized to provide monetary assistance for those lost items.”

It's not surprising that after volunteering for two years, Carolyn has seen a variety of different, interesting cases and finds a great deal of satisfaction in helping to fulfill needs. “We see folks in underserved communities without a lot of support for medical care. We discovered that the Palmetto Palace, a mobile pharmacy/medical unit, would be able to come to some of these communities in the Charleston area. They provide the care that’s really needed, things like getting medications replaced. To have folks be able to come on board their unit and be seen and get signed up for the care they need—I think that’s pretty significant and I’m excited to be partnering with this group.”

Nurses like Carolyn Jacobs continue the proud tradition of service that stretches back to the earliest days of the organization. This service is ongoing and informs the future of nursing in many ways that support workforce development in disaster nursing and public health emergencies. Other nursing leadership initiatives the American Red Cross provides include the Red Cross Nursing Network, which helps the Red Cross recruit, engage, and recognize the nurses and other health professionals who are essential in fulfilling the mission of the Red Cross.

Are you a nurse, nursing or health student, or other health professional? It’s easy to see the most needed volunteer opportunities. You can also use the American Red Cross volunteer role finder to explore opportunities in your community. Be a part of a vital team of volunteers like Carolyn who work tirelessly every day to further the American Red Cross mission of preventing and relieving suffering.