How ITDR can help protect you from the latest Cyber Security Threats

Attacks targeting the identity layer have become a prominent cyber security threat, as attackers adapt to the consolidated corporate IT world of Access Management. Duo’s algorithm research team aligns with Gartner’s Identity Threat Detection and Response (ITDR) to secure customer environments. We have been focusing on securing our customers’ environments by detecting these patterns and encouraging the adoption of best practices, such as FIDO2. We understand that prevention is not enough, and offer Advanced Endpoint Detection and Response to improve customer security and give them visibility into the latest threats. 

1. Device Registration 

“Account Manipulation: Device Registration” (T1098.005) is a technique used by attackers to gain persistence on a device after initial access. Detecting this technique is important as it is often part of an attack chain leading to harmful activities such as ransomware or data exfiltration. Due to the high risk of these rare events, many security teams prefer to recall all events that could indicate this threat type instead of relying on precision alone. 

What can we offer? 

If a phone number has not been previously used by the user = alert. 

If a user registers an authentication device with a laptop or device, they have not used before = alert. 

1. Cookie Theft 

The identity layer operates in conjunction with the endpoint, network, and cloud layers of your environment. There have been instances of malware bypassing endpoint defences and targeting session cookies for exfiltration in the wild, which enables attackers to jump from a user’s endpoint to their cloud accounts. These techniques are referred to as Steal Web Session Cookie (T1539) by MITRE. However, a user’s IP address may change during a session for various benign reasons, making session termination based on this signal alone too disruptive for customers. Therefore, Risk-Based Authentication techniques like Wi-Fi Fingerprint have been implemented to provide Duo with a robust signal that the user is in the same location they authenticated from previously, which can be difficult for attackers to replicate. 

What can we offer? 

If an authentication cookie is used from an IP address or device that it was not issued to = alert. 

1. MFA Fatigue 

This technique, known as Multi-Factor Authentication Request Generation (T1621) by MITRE, is also commonly referred to as MFA fatigue, push fatigue, push harassment, or push grief, and involves an attacker repeatedly prompting the legitimate account holder with authentication requests until they accept after primary credentials have been compromised. 

What can we offer? 

If there are more than a specified amount of requests in ten minutes for a specific user = alert. 

1. Account Takeover 

Also known as Valid Accounts: Cloud Accounts (T108.004), Account Takeover is a term used to describe attacks that don’t fit into any other category of attack techniques or lack attribution confirmation. It can also refer to situations where forensic investigations have not yet established what occurred. In certain cases, account takeover can be associated with malicious account access behaviours, such as accessing an account from a new location or device. Alerting users when such activity occurs is a simple detection measure that can be implemented without external sources. 

What can we offer?  

If an authentication occurs from a location or device that the user has not authenticated from before = alert. 

1. Disabling and Modifying MFA 

Cybersecurity professionals have long been aware of attacks on administrative controls, including those that modify or eliminate multi-factor authentication requirements. Such techniques are referred to by MITRE as Modify Authentication Process: Multi-Factor Authentication (T1556.006). One effective way to protect these controls is by limiting access to specific networks, devices, and accounts, which can be part of a defence-in-depth strategy. Monitoring and establishing detection and response rules to this threat vector can also help improve overall cyber security defences. 

What can we offer? 

If a new administrator account is created = alert. 

If a bypass code is created for an end user = alert. 

If an authentication policy is changed = alert. 

If you want to ensure that your business is following the best cyber security practices to protect you from the latest threats, head over to our Cyber Security page to find out more about how you can protect your business and take our Cyber Security Self Assessment. 

Latest News Stories