New Data Highlights Critical Weaknesses in Enterprise Security
Recent findings have revealed that a staggering 88% of critical and high-severity vulnerabilities identified in live attack simulations within enterprise environments this year were not detectable through vendor advisories or other external sources. This information emerged from a report published on November 2 by Armadin, an offensive security startup founded by Mandiant’s creator, Kevin Mandia. The report focuses on AI-driven attack scenarios conducted on its clients’ active systems, showcasing a significant loophole in the traditional approach to enterprise security.
Armadin’s diverse client base spans nearly a dozen different industries, although the firm has opted not to disclose specific details regarding the number of organizations involved or the precise findings. This data presents a crucial insight into the vulnerabilities that enterprises face but might remain oblivious to due to limited external guidance.
Severe Vulnerabilities: Largely Undetected
The report uncovers that a substantial percentage of security issues stem from flaws in software developed in-house. Specifically, 67% of the critical findings and 78% of high-severity issues were attributed to self-created software defects that external advisories failed to address. Furthermore, 24% and 22% of these vulnerabilities are tied to vendor products being utilized in ways that no existing advisory describes. An unsettling aspect of this finding is the identification of zero-day vulnerabilities—an alarming scenario where the vendor took nearly four months to release an advisory on an issue related to an identity governance platform, despite Armadin discovering the weakness independently.
The data further reveals that nearly 70% of critical and high-severity findings were located within the unauthenticated attack surface. Notably, 82% of the documented attack chains began without requiring user credentials, and 56% of these cases advanced without presenting any form of password or key. A striking feature of these findings is that, in more than 70% of client environments tested, Armadin was able to achieve a critical outcome in three steps or less, all without validating credentials.
The Role of Exposed Service Accounts
Moreover, the report underscores the significance of exposed service accounts. Almost half of the attack chains that started without authentication relied on such exposed credentials, with 71% linked to applications or service accounts instead of human users. Alarmingly, nearly 90% of these service accounts were accessible without requiring extraction, often found in repositories, configuration files, backups, logs, or cloud settings.
In one illustrative case, Armadin initiated a security engagement using an unprivileged domain account. Utilizing a flaw in the backup software, the team was able to read the credentials it contained. This exploit led to gaining access to a hypervisor management server and subsequently to the domain administrator’s credentials through domain controller backups.
Remediation Steps: A Critical Analysis
Addressing the critical findings necessitated various corrective measures. In 51% of the cases, the response involved shipping application code, while 43% of issues required changing settings, permissions, or policies. Additionally, 32% of vulnerabilities were mitigated by rotating exposed credentials, with many vulnerabilities necessitating a combination of these steps to fully resolve the issues.
Armadin has put forth several recommendations aimed at enhancing security protocols. These include formulating robust policies concerning the provisioning, storage, and rotation of service account credentials. Furthermore, emphasizing the need for diligent checks on pipelines and code repositories for any exposed secrets has become increasingly vital in safeguarding against these vulnerabilities.
According to Armadin’s assessment, an impressive 93% of severe findings did not require any third-party intervention for rectification, effectively putting the onus of resolution squarely on the individual organizations.
The Path Forward
As cybersecurity continues to evolve, the challenges posed by these vulnerabilities demand immediate attention. Organizations must reassess their security strategies, placing an increased emphasis on internal weaknesses often overlooked in traditional advisory frameworks. The report by Armadin serves as a wake-up call, prompting enterprises to strengthen their defenses and foster a more proactive approach to vulnerability management.