To bypass corporate network security and gain access to local IT infrastructure, attackers require an average of four days, with a minimum of just 30 minutes. This is evidenced by a study conducted by Positive Technologies.
The evaluation of the security of enterprise network perimeters by Positive Technologies revealed that it is possible to gain access to resources in local networks in 93% of companies, and in 71% of organizations, even a low-skilled hacker can penetrate internal infrastructure. In 77% of cases, the penetration vectors were related to vulnerabilities in web applications. Other methods of penetration mainly involved credential stuffing for accessing various services at the network perimeter, including databases and remote access services.
The Positive Technologies study notes that the weak point of web applications is vulnerabilities found both in proprietary software and in solutions from well-known manufacturers. Specifically, vulnerable software was detected in the IT infrastructure of 53% of companies. "It is essential to regularly conduct security assessments of web applications. The most effective method of testing is source code analysis, which helps identify the greatest number of errors. For the proactive protection of web applications, it is recommended to use an application layer firewall (Web Application Firewall, WAF), which can prevent the exploitation of existing vulnerabilities even if they have not yet been discovered," say the researchers.
The full version of the Positive Technologies analytical study can be found at .
Source: 3dnews.ru
