Threat Models: External Network Attack

In this installment of a threat model series, the focus is on external attacker threats to internet-facing applications, particularly those handling sensitive health and credit card information, using insights from the Mitre Att&ck framework. The application in question operates on a three-layer architecture hosted in a public cloud across data centers in the US and EU. The primary motivations for attackers targeting Software as a Service (SaaS) platforms include monetization through ransomware, extortion, and data exfiltration, often exploiting vulnerabilities in internet-facing components and cloud misconfigurations. The level of sophistication required for these attacks is relatively modest due to widely available tools like Evilginx, making even Multi-Factor Authentication-enabled targets vulnerable. Key threats include data theft, service disruption, and extortion, with vulnerabilities such as weak authentication mechanisms and insecure configurations. Common attack vectors include phishing for administrative credentials, leading to data access and exfiltration. Mitigations focus on preventing lateral movement and identifying anomalous behavior, with encryption being pivotal in minimizing breach impact. Foundational controls for cloud-based infrastructures include robust authentication with hardware-based MFA, web and mail filtering, patching, robust backups, and incident response planning, all of which can be enabled by most Cloud Service Providers. The effectiveness of encryption is contingent on implementation, with field-level encryption being crucial to protecting against network-based attacks. The series will continue to explore threats posed by malicious administrators.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.