A recent report by XM Cyber reveals that only 2% of all known security vulnerabilities provide attackers with access to critically important assets, while 75% of vulnerabilities lead cybercriminals to a dead end, making it impossible for them to compromise the target host and obtain confidential data. To reach this conclusion, researchers analyzed over 60 million cases of infection in more than 10 million local and cloud objects. The Cyntia research institute collaborated on the study, which also suggests that 71% of organizations are at risk on their own local networks, thereby jeopardizing their critical cloud data and assets.
Vice President for Research in XM Cyber, Zur Ulyanitsky, said, “As soon as attackers penetrate the cloud environment, it is easy for them to compromise confidential data. Cloud security has not yet matured, and many security teams do not fully understand the safety concerns they need to address.”
The report indicates that, on average, organizations encounter 11,000 security vulnerabilities every month that cybercriminals can exploit. Additionally, methods targeting data accounting and permissions affect 82% of organizations, and exploits account for over 70% of all identified vulnerabilities. Ulyanitsky added, “Improper management of cloud identifiers and permissions also contributes to the problem. Organizations must review their security approach to protect identification data, systems, and their interdependencies as a whole.”
The XM Cyber study recommends that organizations shift their focus from eliminating a list of over 20,000 vulnerabilities to identifying the most critical vulnerabilities in the external infrastructure that can be exploited by attackers. They should then work on reducing the number of permissions provided by accounts and the number of systems users can access to reduce the risk of the misuse of those accounts during the later stages of an attack. Melissa Bishoping, Director of Endpoint Security Research at Tanium, commented on the report, saying, “Reducing the number of accounts that can access systems ultimately reduces the risk of the abusive use of those accounts in later stages of an attack.”