Ransomware continues to grow fast, increasing by 466% in three years. In addition, 57 vulnerabilities exist today with an entire kill chain mapped — from initial access to exfiltration using the MITRE ATT&CK techniques, tactics and procedures (TTPs) — according to Ivanti’s latest research.
Ransomware groups also continue to grow in sophistication and volume. Thirty-five new vulnerabilities became associated with ransomware in the first nine months of this year. There are 159 trending active exploits today, proving that ransomware is a popular attack strategy with cyber gangs.
Ivanti’s latest Ransomware Index Report Q2-Q3 2022, published today, identifies which vulnerabilities lead to ransomware attacks and how quickly undetected ransomware attackers work to take control of an entire organization. Cyber Security Works, a CVE Numbering Authority (CNA), and Cyware, a leading technology platform provider for building Cyber Fusion Centers, collaborated on the study with Ivanti.
“IT and security teams must urgently adopt a risk-based approach to vulnerability management to better defend against ransomware and other threats. This includes leveraging automation technologies that can correlate data from diverse sources (i.e., network scanners, internal and external vulnerability databases, and penetration tests), measure risk, provide early warning of weaponization, predict attacks and prioritize remediation activities. Organizations that continue to rely on traditional vulnerability management practices, such as solely leveraging the NVD and other public databases to prioritize and patch vulnerabilities, will remain at high risk of cyberattack,” said Srinivas Mukkamala, chief product officer at Ivanti.
Cyberattackers are quick to capitalize on vulnerabilities
Ivanti’s report shows how motivated ransomware attackers are at identifying and taking action on vulnerabilities that quickly lead to taking control of infrastructure undetected. Staying dormant to avoid detection and gradually distributing ransomware across every server they can, ransomware attackers are always on the hunt for new servers and infrastructure to exploit.
Looking at the National Vulnerability Database (NVD) for context into how vulnerabilities progress into trending active exploits, it’s clear that CISOs and their teams need real-time threat intelligence to stay ahead of ransomware attack attempts. The progression pipeline from vulnerability to active exploit is dynamic and changes fast, making real-time visibility across every asset critical.
“Even though post-incident recovery strategies have improved over time, the old adage of prevention being better than cure still rings true. In order to correctly analyze the threat context and effectively prioritize proactive mitigation actions, vulnerability intelligence for secops must be operationalized through resilient orchestration of security processes to ensure the integrity of vulnerable assets” said Anuj Goel, cofounder and CEO at Cyware.
Key insights from the Ivanti study
Finding experienced cybersecurity experts and IT professionals continues to be a challenge for every organization. Another gap attackers exploit is when organizations don’t have enough experts on staff who know how to use threat intelligence tools, automate patch management and reduce the risks of ransomware attacks. Having a fully staffed IT and cybersecurity team helps to take on the growing risks and threats the Ivanti report found, which are summarized here…
Read Full Source: VentureBeat
By Louis Columbus
The ‘Cloud Syndicate’ is a mix of short term guest contributors, curated resources and syndication partners covering a variety of interesting technology related topics. Contact us for syndication details on how to connect your technology article or news feed to our syndication network.
Originally posted on October 31, 2022 @ 1:18 pm
