Huntress Reviews 2021 Cybersecurity Trends and Lessons
Summary
Huntress reviews 2021 trends including ransomware, exposed servers, supply-chain attacks, LOLBins, incomplete remediation and alert fatigue, and shares defensive lessons such as isolating backups, enabling MFA and planning incident response.
Key points
- The article says researchers observed more than twice as many zero-day attacks in 2021 as in 2020, attributing wider access partly to underground marketplaces and hacker-for-hire services.
- It recommends isolating protected offsite backups to support recovery from ransomware.
- For public-facing servers, it advises enabling MFA on remote access and segmenting those servers from production networks.
- To limit the impact of one-to-many attacks, it recommends restricting domain trust and persistent remote access between environments and avoiding shared credentials.
- Attackers may use built-in Windows tools, or LOLBins, to blend malicious activity into normal administration; the article advises ensuring security tools can detect and investigate suspicious use.
- It warns that incomplete remediation can leave attackers or unpatched systems behind, and recommends a defined, tested incident-response process, including tabletop exercises.
- To address alert fatigue, it recommends validating security controls and preparing for incident response outside business hours.
Article Details
- Topic
- Cybersecurity trends and lessons from 2021, including ransomware, zero-day attacks, exposed servers, supply-chain attacks, living-off-the-land binaries, incomplete remediation, and alert fatigue.
MITRE ATT&CK
Products
Microsoft Exchangean interesting flip side to these open and easy-to-access ports, though. You probably remember the Microsoft Exchange breach that happened back in March 2021. Ironically, the FBI was able to take advantage of thatMicrosoft Windowsare one of the more dangerous attack tactics because of how stealthy they are. Attackers use built-in Windows tools to perform attacks, making it easier than ever for threat actors to remain hidden. They blend right