For bypassing corporate network security and gaining access to the local IT infrastructure of organizations, attackers, on average, require four days, with a minimum of 30 minutes. This is evidenced by of a study conducted by Positive Technologies.
An assessment of the security of the network perimeter of enterprises conducted by Positive Technologies showed that access to resources on the local network is possible in 93% of companies, and in 71% of organizations, even a low-skilled hacker can penetrate the internal infrastructure. In 77% of cases, the infiltration vectors were related to weaknesses in web application security. Other methods of intrusion mainly involved credential stuffing to access various services on the network perimeter, including databases and remote access services.
The study by Positive Technologies notes that the weak point of web applications lies in vulnerabilities that are found both in in-house developed software and in solutions from well-known manufacturers. In particular, vulnerable software was discovered in the IT infrastructure of 53% of companies. "Regular security assessments of web applications are necessary. The most effective method of testing is source code analysis, which allows for the identification of the greatest number of errors. For preventive protection of web applications, it is recommended to use an application layer firewall (Web Application Firewall, WAF), which helps to prevent the exploitation of existing vulnerabilities, even if they have not yet been detected," say the researchers.
You can find the full version of the analytical study by Positive Technologies at .
Kilde: 3dnews.ru
