<\/p>\n
![](\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/expert-perspective\/expert-perspectives-v3.jpg\")
<\/div>\nIn addition, email-based attacks will get progressively harder to detect due to generative AI (GenAI) which can allow an adversary to craft phishing and business email compromise (BEC) messages in very realistic and enticing ways\u2014and in any language. This further expands the pool of potential phishing targets.<\/p>\n
What enterprises can do<\/i><\/b><\/p>\n
Go beyond native email security by choosing a vendor with layered defense via the following technologies:<\/p>\n
1. An email gateway<\/b>, leveraging AI, ML, behavioral analysis, and authorship analysis;<\/p>\n
2. Cloud application security broker (CASB)<\/a> technology<\/b>, analyzing inbox emails via the scanning of links, attachments, and messages between peers to prevent compromised accounts from phishing other employees;<\/p>\n 3. A secure web gateway (SWG)<\/a>, providing additional protection if a malicious link is clicked by inspecting traffic inline, performing image analysis, and using ML to analyze branded elements, login forms, and other site content to recognize fake websites;<\/p>\n 4. User education <\/b>via built-in security awareness simulations and training where, ideally, the vendor will offer phishing tests<\/a> based on templates extracted from recent, real phishing scams<\/p>\n 2. Web and web applications<\/span><\/p>\n The risks<\/i><\/b><\/p>\n Cross-site scripting (XSS) attacks take advantage of coding flaws on websites or web applications to generate input from users. It\u2019s no wonder why XSS remains a mainstay on the Open Web Application Security Project (OWASP) Top 10 Web Application Security Risks<\/a>\u2014a severe XSS vulnerability<\/a> in Ivory Search, a WordPress search plugin, left 60,000 websites open to malicious code injection. With remote work and the shift to cloud services resulting in a boom of websites and applications, enterprises need to strengthen their defense for this initial attack vector.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n What you can do<\/i><\/b><\/p>\n Consider taking the following three actions to help minimize your risk:<\/p>\n In addition, CASB can help you reduce the risks of using software-as-a-service (SaaS) apps without impacting the user experience. It counters shadow IT, secures cloud account compromises, and addresses security gaps for third-party services like Ivory Search. Furthermore, CASB complements the threat-blocking capabilities of SWG solutions and benefits from integration with the analytical power of extended detection and response (XDR)<\/a>.<\/p>\n The disparate logs of these once-discrete solutions combine to offer a more holistic view of your environment, allowing for the creation of a more thorough risk profile.<\/p>\n 3. Vulnerabilities<\/span><\/p>\n The risks<\/i><\/b><\/p>\n Vulnerabilities can disrupt business operations by causing system blackouts or closures. Swedish grocery chain Coop<\/a>, for example, was forced to shut down 800 stores after malicious actors leveraged multiple zero-day vulnerabilities in Kaseya\u2019s Virtual System Administrator (VSA) product to launch a ransomware attack.<\/p>\n In addition, zero-days, n-days, and forever-days<\/a> continue to increase. Trend\u2122 Research reported a 23%<\/a> increase in the number of critical and high-severity vulnerabilities during the first half of 2022 submitted to the Trend Micro\u2122 Zero Day Initiative\u2122 (ZDI)<\/a> bug bounty program.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n What you can do<\/i><\/b><\/p>\n These five risk-based patch management best practices<\/a> can help you create a strong defense program against vulnerability exploitation:<\/p>\n 1. Identify which patches are most relevant <\/b>using a prioritized patching process and checking the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerability catalog<\/a>.<\/p>\n 2. Make a zero-day plan for when, not if<\/b> by consistently monitoring networks for suspicious activity, and by staying up to date with bug bounty programs like ZDI that leverage global threat intelligence<\/p>\n 3. Communicate with vendors <\/b>about the possibility of rollbacks to previous versions of software<\/p>\n 4. Utilize virtual patching<\/b> to protect vulnerable systems while waiting for a vendor patch to be released<\/p>\n 5. Share benefits with stakeholders<\/b> to encourage a culture of security within the organization as well as demonstrate the ROI of cybersecurity to the board<\/p>\n The use of ASRM aligns with these steps in making your risk monitoring and measurement processes more streamlined, informed, and effective. Analyze a wide range of important elements including your asset criticality, vulnerabilities, security posture, threat activity, and exposure. Taking the guesswork out of what impacts your risk enables more effective decision-making, translating to a stronger risk response.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n 4. Devices<\/span><\/p>\n The risks<\/i><\/b><\/p>\n The shift to remote work exposed the dangers of virtual private networks (VPNs)\u2014an initial attack vector which grants access to the entire network. While a remote worker may only access legitimate work apps, other devices in the household could spread malware through an unsecured machine connected to the VPN. And considering that 82% of data breaches<\/a> involved a human element, more devices with access to an organization\u2019s entire network effectively translates to higher cyber risk.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n What you can do<\/i><\/b><\/p>\n 63% of organizations<\/a> are making the move from a VPN to zero trust network access (ZTNA) to reduce cyber risk across the attack surface as part of a broader zero trust strategy. ZTNA continuously verifies the trust of users and devices, and only grants access to the web-portal frontend, which stops a compromised device from leapfrogging their attack across the attack surface.<\/p>\n Furthermore, ZTNA provides the scalability needed to support evolving business operations. The specific application-to-user connection doesn\u2019t require the bandwidth that VPNs do, enabling high-performance availability and consistent delivery without negatively impacting the user experience.<\/p>\n 5. Island hopping<\/span><\/p>\n The risks<\/i><\/b><\/p>\n Island hopping, as the term implies, is used to pivot from an external environment into your network. Software supply chain attacks<\/a> are increasing in frequency due to the success of those impacting Kaseya, Log4j, and SolarWinds. Within this initial attack vector lies many others including data distribution services (DDS), open-source code, system management tools, and purchased applications.<\/p>\n A Trend global survey<\/a> reported that 52% of organizations have a supply chain partner that has been hit by ransomware, meaning their systems were at risk as well.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n What you can do<\/i><\/b><\/p>\n The CISA-published Information and Communications Technology (ICT) Supply Chain Risk Management (SCRM)<\/a> Essentials recommends six key steps to building effective software supply chain security:<\/p>\n 1. Identify:<\/b> Determine who needs to be involved<\/p>\n 2. Manage:<\/b> Develop your supply chain security policies and procedures based on industry standards and best practices, such as those published by the National Institute of Standards and Technology (NIST)<\/p>\n 3. Assess:<\/b> Understand your hardware, software, and services that you procure<\/p>\n 4. Know: <\/b>Map your supply chain to better understand what component you procure<\/p>\n 5. Verify:<\/b> Determine how your organization will assess the security culture of suppliers<\/p>\n 6. Evaluate: <\/b>Establish timeframes and systems for checking supply chain practices against guidelines<\/p>\n<\/p><\/div>\n<\/p><\/div>\n 6. Insider<\/span><\/p>\n The risks<\/i><\/b><\/p>\n A 2022 Ponemon Institute global report<\/a> found that the time to contain an insider threat increased from 77 to 85 days, causing organizations to spend the most on containment. Furthermore, incidents that took more than 90 days to contain cost an overage of US $17.19 million on an annualized basis. Whether the insider is simply accidental, negligent, or malicious, the price to pay remains high.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n What you can do<\/i><\/b><\/p>\n Improving cyber hygiene<\/a> through security awareness training can help businesses avoid the accidental or negligent insiders. To address the other types of insiders, continuous monitoring of ingress and egress traffic is essential. And if this initial attack vector is exploited, having an incident response plan in place will help contain the threat quickly to limit the spread and financial impact.<\/p>\n 7. Cloud<\/span><\/p>\n The risks<\/i><\/b><\/p>\n Digital transformation has accelerated cloud adoption, which presents new cybersecurity risk. In the Trend Micro 2024 Midyear Cybersecurity Threat Report<\/a><\/i>, risky cloud app access was ranked number one of the top five risk events during the first half of the year. We also reported<\/a> in May 2024 how misconfigured Container Advisor (cAdvisor) deployments can lead to threat actors exploiting vulnerabilities via container images, reconnaisance, and other approaches. In addition, per IBM\u2019s 2024 Cost of a Data Breach Report<\/i>, the most expensive types of breaches were solely focused on public cloud, averaging US $5.17 million\u2014up 13.1% from 2023\u2014while multi-environment breaches were slightly less expensive but more commonplace.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n What you can do<\/i><\/b><\/p>\n Leveraging a cloud-native security platform that supports multi and hybrid-cloud environments is critical. Look for a platform that can automate as many things as possible, from scanning infrastructure as code (IaC), open-source code, containers, and cloud workloads to setting clear security policies and performing compliance checks.<\/p>\n A unified cybersecurity approach to protecting attack vectors<\/span><\/p>\n You might get to the end of this and be overwhelmed by the number of new security products you need. Truthfully, deploying and maintaining disparate security tools at each layer is simply unmanageable, especially with the skills gap and turnover. Consider a unified, AI-powered cybersecurity platform<\/a> to reduce complexity and augment existing resources, all while ensuring security maturity.<\/p>\n Using a unified platform across multiple environments that supports broad third-party integrations ensures comprehensive visibility from a single dashboard. Security capabilities such as automation, continuous monitoring, and XDR are critical to ASRM. Visibility and deep data correlation enable security teams to discover, assess, and mitigate threats across the attack surface risk lifecycle.<\/p>\n Trend has been at the forefront of AI innovation since 2005, empowering security operations center (SOC) analysists and threat hunters alike with technologies that streamline their operations\u2014and help bolster their risk response. Through solutions such as Trend Companion\u2122<\/a> and the Trend Vision One\u2122<\/a> platform, opportunities abound for organizations to leverage deeper data, harness high-quality analysis, and reveal meaningful, actionable insights.<\/p>\n To learn more about ASRM, check out the following resources:<\/p>\n<\/p><\/div>\n<\/p><\/div>\n\n\n\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n