A cloud account takeover affects companies that use cloud applications like Microsoft Office 365 or Google G Suite. This is a popular type of attack by cybercriminals because it is often difficult to detect. It may take months or years for a business to discover the attack, by which time the cybercriminal may have done significant harm.
The cybercriminal often gains access to the system through phishing emails, third-party breaches, or applications. Once they have access, they are able to reach other accounts and information they can further manipulate. Below, we discuss how to detect and prevent a cloud account takeover so you will know how to protect your business if you are targeted.
How to Monitor for a Cloud Account Takeover
Some potential red flags that may indicate that a cybercriminal is attempting to take over your cloud account include:
1. Unusual Login Locations
You can check the login location for many cloud accounts and see if any attempts originated somewhere unusual, such as in another state or country. You can then update your security options to prohibit logins from these suspicious locations. You can work with your security team by providing necessary access to workers who are traveling and in such locations.
2. Multiple Failed Login Attempts
While it is common for users to sometimes forget their passwords and request new ones, many such attempts may signal an attempt to infiltrate the system. Be on the lookout for hundreds of login attempts on a single account within a short period of time or mass password reset requests. You can combat this potential problem by managing your passwords carefully and locking out users after a few tries of failed attempts.
3. Malicious OAuth Connections
OAuth is often used to connect SaaS applications to the cloud, but this can also result in connecting to a malicious app. Once the malicious app is in play, the cybercriminal may then start to send lateral phishing emails through this compromised account. These emails may contain phishing links that others are more likely to click on since the email comes from an internal account.
4. A Large Number of Chargeback Requests
Another sign that you have been the victim of account takeover is if you suddenly receive a large number of chargeback requests from your customers.
5. Multiple Changes to an Account
If there are multiple changes to a single account at one time, this may be an indication of account takeover fraud. For example, a customer may suddenly change the device they are using, their password, and their address all at the same time.
6. Abnormal File Sharing and Downloading
Cybercriminals often work together to steal as much information as possible. One way this is done is by sharing sensitive information with other users. You may notice more downloading and file sharing activity than usual.
How to Prevent Cloud Account Takeover and Identity Theft
Due to the potential pitfalls associated with cloud account takeover, it is important that you prevent such attacks from occurring in the first place. Here are some of the most effective ways to prevent cloud account takeover and identity theft:
- Create strong passwords
- Put appropriate security protocol in place, including notifications if changes have been made to your account
- Implement two-step verification
- Implement data protection best practices
- Train staff on common phishing scams and use reverse lookup services to be protected
- Use software that analyzes data quickly to precisely detect account takeover attempts
Conclusion
By using these tips and tricks, you can protect your cloud account and quickly take action if suspicious activity occurs.
##
About the Author
Ben Hartwig is a web operations director at InfoTracer. He authors guides on marketing and entire cybersecurity posture and enjoys sharing the best practices. You can contact the author via LinkedIn.
