The world’s five leading cybersecurity authorities have again issued a joint report about an increase in malicious cyber activity targeting managed service providers they expect to continue.
If you’re not familiar with the “Five Eyes”, it’s a term used to reference the cybersecurity agencies in the United Kingdom (NCSC-UK), Australia (ACSC), Canada (CCCS), New Zealand (NCSC-NZ), and the United States (CISA, NSA, and FBI). These agencies have independently issuing warnings over the last few years, but it’s only now that the problem of cybercriminals attacking managed service providers (MSP) has become a problem.
Much like the increases in supply chain attacks that have been observed over the last 2 years, MSPs serve the same purpose to a cybercriminal – providing elevated access to a multitude of customers by attacking the one MSP.
In the “Five Eyes” joint report, several recommendations are made:
- Improve the security of vulnerable devices including vulnerability management for all devices, with special focus on VPN solutions that provide external access.
- Protect internet-facing services with particular focus on protecting against credential stuffing.
- Defend against brute force and password spraying where pwned or compromised credentials can be used to attempt to gain access to MSP resources or networks.
- Defend against phishing by using Security Awareness Training to educate users on how phishing attacks work, as well as phishing testing as a feedback loop to understand which users in your environment pose the greatest risk (and need more training).
