With organizations increasingly adopting advanced technologies to strengthen their infrastructure as protection from sophisticated attacks, it is becoming difficult for threat actors to carry out their malicious intent. Hence, they are resorting to older techniques that are cheap while enabling them to carry out their intent successfully.
Cyber-attacks have proliferated in the past couple of years. With organizations accelerating their digital transformation initiatives to sustain their business operations, they failed to take the required precautions to safeguard their infrastructure against cybersecurity threats. This provided threat actors with multiple windows of opportunities to launch their cyber-attackers and achieve their objectives. But, as organizations stepped in 2022, they decided to address this situation.
Most organizations are heavily investing in cybersecurity to strengthen their infrastructure. They are employing experts who can help them fill the gaps in cybersecurity that emerged with digital technologies. While renowned cybercriminals continue to use sophisticated attack vectors to carry out their malicious intent, they still use old ones when new vectors are shut or become difficult to execute due to the efforts of law enforcement. Another reason cybercriminals prefer old attack vectors is to get their message across to the key targets that occasionally force them to fall back to old vectors.
Also Read: Top Five Cybersecurity Measures C-Suite Leaders Must Adhere to
Here are five out-of-date attack vectors cybercriminals still utilize and what CISOs can do to safeguard against them:
Macro viruses
Threat actors continue to target firms by using viruses written in macro language as well as hidden in documents. Even after there are multiple ways for organizations to safeguard themselves as well as guidance from the likes of the UK’s, US NIST, NCSC, and Australian ACSC, it is still difficult for organizations to completely defend themselves.
Most of the vectors related to macros still rely on social engineering. Additionally, threat actors might utilize macros for cybercrime or more sophisticated exploitation attempts. Dealing with this issue requires organizations to educate and place technical controls at the gateway and endpoint.
Launching attacks by exploited old, unpatched vulnerabilities
Also Read: Why is Hybrid Employment a Nightmare for the Cybersecurity Teams?
Targeting previously identified vulnerabilities for malicious intent is gaining traction among cyber criminals. In fact, a 2021 research from Qualys examined Common Vulnerabilities and Exposure (CVEs) used in ransomware attacks in recent years. The research revealed that some of these vulnerabilities used to exploit today’s organizations have been in existence for nearly a decade. But many organizations still did not apply the necessary security updates, keeping their organizations vulnerable to cyber-attacks. Therefore, it is crucial for organizations to prioritize these efforts and ingrain this practice into the culture of their organization.
SQL Injection to manipulate web applications/pages
Even though they are the oldest attack vector, threat actors continue to use them to infect applications/webpages while simultaneously accessing databases that sit behind them. While it is not a new or innovative approach, cybercriminals understand that they do not have to reinvent the wheat to get the results. Addressing this issue requires organizations to prevent these attacks by having dynamic application security testing (DAST) as well as static application security testing (SAST).
For more such updates follow us on Google News ITsecuritywire News. Please subscribe to our Newsletter for more updates.
