Industry executives and experts share their predictions for 2022. Read them in this 14th annual VMblog.com series exclusive.
2022 Hybrid Identity Security Predictions
By Sean Deuby, Director of Services at Semperis, and Elad Shamir, Director of Breach Preparedness & Response at Semperis
With the pandemic driving increased large-scale remote and work-from-home activities and accelerated cloud migration plans, the cybersecurity landscape has become larger than it ever has before. From leveraging a growing number of hybrid identity environments to exploiting known security vulnerabilities, attackers continue to launch an onslaught of successful cyberattacks.
Against a backdrop of surging attacks, it’s hard to know what tactics attackers will capitalize on next. Below are the top trends organizations should be aware of as they look to bolster their hybrid identity security strategies in the coming year.
Hybrid identity systems will continue to be a lucrative target for attackers
Identity systems are a perfect target for cybercriminals. With stolen credentials attackers can cause devastating damage, as the recent attacks on healthcare systems have shown. When the identity system is down, users can’t log on to access services and applications, so business operations come to a halt. Hybrid identity systems-often encompassing both on-premises Active Directory and Azure Active Directory-are especially lucrative targets. Cybercriminals can use stolen credentials to breach on-prem AD, then move laterally to the cloud-or vice versa. In 2022, we’ll see more attacks that start with Azure AD, where it’s relatively easy to gain an initial foothold (through phishing, for example) and then breach the network where the “crown jewels,” the high-level admin accounts, are located. Given that businesses around the world depend on Microsoft Azure, Azure AD acts as a major identity provider, authenticating literally hundreds of thousands of users every minute. Malicious actors will continue to look for ways to cause as much damage as possible, as quickly as possible. Targeting Azure AD and other cloud IdPs is an efficient way to accomplish this mission.
Sophisticated ransomware attacks will come from unsophisticated attackers
Anyone with malicious intent can easily acquire stolen credentials-which are sold for surprisingly low amounts of money these days-and use any number of available tools to breach systems. For those would-be attackers who lack the technical skills to accomplish an exploit, ransomware-as-a-service operations are happy to help do the dirty work. Although various governments are cracking down on these operations, RaaS outfits will continue to “disappear,” then reformulate in other entities, so they will continue to be a pernicious threat to security worldwide. Once attackers succeed in extracting money or inflicting other types of damage, they will repeat the process for as long as it’s successful. Industries that deal with large amounts of highly regulated customer data-especially healthcare organizations-will be particularly vulnerable.
Organizations that finally devote resources to closing known attack vectors will significantly reduce their risk of attack
The security industry-specifically security researchers and red teamers – are years ahead of malicious actors in uncovering identity-related attack vectors. Most of the time, new paths are initiated by the security industry and not from analysis of what’s happening in the wild. So why are malicious actors succeeding? They’re using old standbys-tried-and-true methods that have worked for years because organizations have not taken the time nor spent the resources to effectively close those attack paths. For 2022, the organizations that double down on addressing security gaps will be more likely to stay ahead of attackers. Malicious actors will instead go after victims that somehow couldn’t find the time or spend the effort to fix these known vulnerabilities. No organization can build an impenetrable defense against cyberattacks. But failing to tackle the low-hanging fruit from a security perspective just makes your organization easy pickings for cyberattackers – and they still go after the easy pickings first.
Finding and fixing identity-related vulnerabilities has never been as urgent as it is now. Tracking trends in hybrid identity security can help organizations know how they can address today’s security problems while also planning for the future.
##
ABOUT THE AUTHORS
About Sean Deuby
Sean brings 30 years’ experience in enterprise IT and hybrid identity to his role as Director of Services at Semperis. An original architect and technical leader of Intel’s Active Directory, Texas Instrument’s NT network, and 15-time MVP alumnus, Sean has been involved with Microsoft identity since its inception. Since then, his experience as an identity strategy consultant for many Fortune 500 companies gives him a broad perspective on the challenges of today’s identity-centered security. Sean is an industry journalism veteran; as former technical director for Windows IT Pro, he has over 400 published articles on AD, hybrid identity, and Windows Server.
About Elad Shamir
Elad has over fifteen years of experience across the different domains of information security and spent most of his career focusing on security research and delivering offensive security services, such as red team adversary simulations and penetration tests. Previously, Elad served in the Israeli intelligence and worked in the private sector in Israel, Australia, and the United States, most recently as a senior member of the Adversary Simulation team at SpecterOps. Elad specializes in identifying security flaws in complex systems and weaponizing intended functionality for offensive capabilities, particularly in Windows and Active Directory environments.
