The Digital Defense Report 2023, the technical view
Nov 11th, 2023 by Jesper Kråkhede
The Microsoft Digital Defense Report 2023 is out, and once again I have read it with an incident responder´s eyes.
Some of the findings. Human operated ransomware attacks have tripled since September 2022. Password attacks have increased more than tenfold compared with the year before, to more than 4,000 per second. The large majority of successful ransomware compromises start through unmanaged devices. And basic security hygiene still protects against 99 % of attacks.
The report also presents a set of foundational principles against ransomware: modern authentication with phishing resistant credentials, least privilege across the whole technology stack, threat and risk free environments, posture management for devices and services, and automatic cloud backup and file syncing for important data.
Technically, my takeaways are these. Find your unmanaged devices and either manage them or keep them away from your resources. Move to authentication that can´t be phished, starting with admins. Remove standing privileges. And make sure your EDR and your identity protection can stop an attack automatically, because attackers are now so fast that a human can´t always respond in time.
Most of this isn´t new. That is exactly the point.
Do the basics. They still stop almost everything.