In an exclusive interview with Help Net Security, Adam Bateman, CEO of Push Security, sheds light on the alarming surge in identity-based attacks, noting their increasing sophistication each year. He emphasizes the pivotal role of artificial intelligence (AI) and machine learning (ML) in both fueling these threats and fortifying defenses against them.
The scale of identity-based attacks has reached unprecedented levels, with over 22 billion credential-stuffing attacks reported globally in 2023 alone. Shockingly, nearly 80% of cyber incidents in 2024 were linked to stolen or compromised credentials, despite the existence of multi-factor authentication measures. Attack techniques have evolved to outsmart security measures, with phishing attacks adeptly bypassing MFA and cybercriminals employing session-stealing infostealers on an industrial scale.
A significant milestone in 2024 was the high-profile attacks on Snowflake customers, where 165 organizations worldwide fell victim to credential theft orchestrated through infostealer infections dating back to 2020. To call attention to this evolving threat landscape, Push Security’s research team developed an open-source matrix, highlighting the latest identity-based techniques targeting cloud identities and SaaS services. The magnitude of breaches involving prominent companies underscores the gravity of identity-based attacks.
The integration of AI and ML in cybersecurity presents a dual-edged sword. While cybercriminals leverage these technologies to enhance the speed and efficacy of their attacks, defenders harness AI and ML to analyze extensive datasets swiftly, detecting unusual behavior indicative of compromised credentials. Adaptive authentication, driven by ML, can dynamically adjust security measures based on the perceived level of risk, ensuring a balance between user convenience and robust protection.
Employee training emerges as a critical factor in thwarting social engineering and identity-based attacks, as evidenced by Verizon’s 2024 Data Breach Investigations Report attributing 69% of breaches to human error. While targeted security training proves beneficial, reducing human dependence through technical controls is paramount. Providing real-time guidance and implementing preventive measures, such as blocking password entry on phishing sites, significantly mitigates human error vulnerabilities.
Balancing security with usability poses a challenge for businesses, as stringent measures can impede user efficiency, while leniency compromises system security. Tools like single sign-on (SSO) and passwordless authentication streamline user access without compromising security protocols. Organizations must tailor controls based on the sensitivity of applications and user activities, empowering them to adjust security safeguards in response to evolving threats.
In conclusion, as the threat landscape continues to evolve, businesses must leverage technology, employee training, and strategic controls to safeguard against identity-based attacks while maintaining a seamless user experience. By staying vigilant and proactive in implementing robust security measures, organizations can effectively mitigate risks and protect their valuable assets in an increasingly hostile digital environment.