The shift to Cloud, coupled with COVID-19, has seen massive opportunities for cybercriminals to attack infrastructure. You cannot rely on your Cloud provider, you need to be able to self assess, or work with a professional cybersecurity team to assist.
Your focus on assets should start with a simple check list to discover and isolate concerns:
- Enumeration: when an attacker targets a host to discover potential attack vectors, using leaked information or metadata for further exploitation of the system.
- Criticality: the value assigned to an asset that reflects its relative importance or necessity to an organization.
- Weakness: when a system, procedures, control, or implementation could be exploited or triggered by an attacker. A weakness is likely to result in security and privacy risks for your organization.
- Post-exploitation potential: is the base value and capabilities of the compromised system to gain access to other areas of the targeted systems without even being detected.
- Vulnerability research: Vulnerability Research is not just undertaken by your Cybersecurity team, attackers also target easy to exploit systems. 80% of Exploits Publish Faster than CVEs giving attackers plenty of space to make a move.
- Attacker ROI: Understanding the business model of an attacker and realizing that attackers invest time, research and human capital creating exploits and building tools highlights that they want the highest possible ROI.
To determine your asset risk for cyberattack, consider the following:
- What information is being leaked to the outside from your assets, due to mis or incomplete configuration?
- How valuable is this asset to attacker, and how critical is the asset to your organization?
- Are there known exploits or weaknesses in the asset?
- Will exploiting this asset allow an attacker access to the rest of your systems?
- How long will it take to develop an exploit or are exploits easily available?
- Is there repeatable ROI for developing an exploit that attacks your asset?
About
Sakura Sky provides cloud, data, and security services to the world’s leading brands.
With innovation at our core, Sakura serves enterprise clients and thousands of other businesses around the world. Our global team provides cloud strategy, implementation and integration support, machine learning and data science, Cybersecurity, and training services.
Sakura Sky is headquartered in San Francisco with a delivery footprint across Asia, North America, Europe, and Australia.
Learn More
Contact us to learn more.
