The Digital Defense Report 2022, the technical view
Aug 14th, 2023 by Jesper Kråkhede
I have gone back to the Microsoft Digital Defense Report 2022 this summer, with a technical eye.
A few numbers that stood out. The volume of password attacks rose to an estimated 921 attacks every second, a 74 % increase in one year. And 93 % of Microsoft´s ransomware incident response engagements found insufficient controls on privileged access and lateral movement. That number doesn´t surprise me at all, given what I see.
The report also describes how the war in Ukraine started with a destructive cyberattack hours before the invasion, and how fast attackers now exploit new vulnerabilities once they are published.
What does it mean technically? First, passwords alone are not enough. Strong authentication, preferably a kind that can´t be phished, is the base. Second, privileged access and lateral movement are where ransomware attacks are won or lost. Tier your admins, use dedicated admin devices and limit where admin accounts can log on. Third, patch internet facing systems quickly. The time between publication and exploitation keeps getting shorter. Fourth, use the cloud´s security capabilities. The report points out that the cloud gave Ukraine both physical and logical protection.
None of this is new. What is new is the scale.
Read the report. Then go check your Domain Admins group.