Phishing is now the number one cyber threat faced by businesses but in spite of a high risk of phishing attacks occurring, businesses have been slow to respond to the threat and implement cybersecurity solutions to reduce the risk of email-related data breaches.

A recent survey Valimail sponsored survey has shown that anti-phishing defenses are lacking at many U.S. businesses. The survey was conducted on 650 IT/IT security professionals by the Ponemon Institute. The companies had an average of 1,000 employees with average annual email security and fraud prevention budget of $2.5 million.

The high risk of email-based attacks was made abundantly clear. 79% of respondents said that they had experienced a data breach or cyberattack in the past 12 months that certainly or likely involved email, such as a business email compromise attack or a phishing incident.

80% of respondents said they were very concerned about their organization’s ability to prevent or reduce email-based attacks and 53% of respondents admitted that preventing phishing attacks was very difficult.

Even though the risk of attack is high and breaches have been experienced, only 29% of respondents said their organization had taken significant steps to tackle the threat from phishing and email impersonation attacks. More than one fifth of firms (21%) said they had taken no steps to reduce the risk of phishing attacks.

When asked about the anti-phishing defenses that had been implemented, 69% of respondents said they had implemented anti-spam or anti-phishing filters and 56% used secure email gateway technology. Only a third of respondents (34%) said they provide anti-phishing training for employees. Even fewer (29%) have implemented Domain-Based Message Authentication and Conformance (DMARC) and Sender Policy Framework (27%) to detect and prevent email impersonation attacks.

The high number of phishing attacks and data breaches appears to have spurred many businesses to make improvements to email security. In the next 12 months, 65% of respondents said their company will be investing in anti-spam filters, 63% will be using secure email gateway technology, 47% will be using SIEM technology, and 57% will be providing anti-phishing training to employees.

Only 35% will be adopting DMARC and 23% said they planned to implement SPF. Approximately two thirds of companies would consider implementing an automated DMARC enforcement solution if it could completely stop impersonation attacks that spoof email domains and block inbound email from unknown and untrustworthy senders.

39% of respondents said their company was not spending enough on email security to stop phishing and email impersonation attacks with budget constraints a major hurdle that must be overcome.

56% of respondents said that it would likely take a serious hacking incident to get a budget increase to pay for improvements to email security. 65% said that the board would likely be swayed by concern over the loss of customers due to a security incident and 47% said concern over loss of revenue due to a security incident could result in a budget increase.

When asked how much difference a 20% increase in their email security budget would make, respondents estimated it would improve the email threat detection rate by 45% and the phishing/impersonation attack prevention rate by 33%. Without sufficient investment in email security, costly email-related data breaches are likely to continue.

The post Survey Reveals Lack of Anti-Phishing Measures at U.S. Businesses appeared first on HIPAA Journal.

A vulnerability has been discovered in Microsoft’s Active Directory Federation Services (ADFS) that allows multi-factor authentication (MFA) to be bypassed with ease. The flaw is being tracked as CVE-2018-8340 and was discovered by Andrew Lee, a security researcher at Okta.

ADFS is used by many organizations to help secure accounts and ADFA is used by vendors such as SecureAuth, Okta, and RSA to add multi-factor authentication to their security offerings.

To exploit the vulnerability an attacker would need to obtain the login credentials of an employee and have a valid second factor authentication token. That token could then be used as authentication to access any other person’s account if their username and password is known.

A threat actor could easily obtain a username and a password by conducting a phishing campaign. The number of phishing attacks on healthcare organizations that have been reported recently show just how easy it is to fool employees into disclosing their login credentials. A brute force attempt on an account with a weak password would also work.

Obtaining the second factor token is a little more difficult. The second factor is often a mobile phone number or email address or a smart card PIN number. That information could also potentially be obtained through phishing or through a successful attempt to get the IT help desk to reset a user’s MFA token.

The vulnerability would be easy to exploit by an insider, since that person would already have a valid MFA token registered on the system. All that would be required to access the account of another employee would be their username and password.

The vulnerability is due to the way ADFS communicates during a login. When an attempt is made to login, the server sends an encrypted context log which contains the MFA token. However, the context log does not include the username, so no check is performed to ensure the MFA token is being used by the correct individual. If an attacker used a browser to gain access to an account using a known username/password and MFA token, and a second browser with just a username and password but no MFA token, a single MFA token could be used to gain access to both accounts.

Two-factor authentication is an important security control that can prevent unauthorized account access even if a threat actor has successfully obtained login credentials, although this vulnerability shows that the system is not infallible.

The flaw has now been fixed in Microsoft’s Patch Tuesday updates on August 14. Healthcare organizations should ensure that the patch is applied promptly to ensure their MFA controls cannot be easily bypassed.

The post Microsoft ADFS Vulnerability Allows Bypassing of Multi-Factor Authentication appeared first on HIPAA Journal.