It’s Getting Real & Hitting the Fan 2023 Edition (Real World SaaS Attacks)
summary
Yearly overview that focuses on concrete incidents: a DocuSign phishing campaign uses Adversary-in-the-Middle to bypass MFA and creates persistent authenticators, hitting over 4,000 attempts across organizations; an Okta compromise leads to SSO-driven access to 15 apps and a ransomware extortion that actually exfiltrates about 20 GB stolen (not the claimed 585 GB); operators note default session windows and 90 days of logs limit forensic visibility.
AI-written summary · about
chapters (31)
- 0:00Intro
- 0:29Speaker
- 1:02About Mitiga
- 1:33Introduction
- 3:18Breach Cost Continues to Rise - 4.35M
- 3:55Breaches Moving to Cloud & SaaS
- 5:58Initial Attack Vector - Identity 33%
- 6:30The Death of MFA - MFA Push Fatigue
- 7:21The Death of MFA-Adversary in the Middle
- 8:35BEC Leveraging AitM MFA Persisteny Campaign
- 9:27Suspicious Email
- 10:13The BEC Scheme
- 11:08Incident Timeline
- 14:38Phishing Email
- 16:15Creating new Authenticator
- 16:44No MFA Challenge Needed!
- 18:44Initial Investigation (by Customer)
- 19:20Limited Containment?
- 20:54Major Incident Declared
- 21:38Initial Access-Phishing, MFA Fatigue x 2
- 23:43What Exactly was Compromised?
- 25:40Ransom (Extortion) Negotiations
- 27:42Response - Investigate/Hunt
- 28:59Circle CI Breach
- 29:24Investigating CircleCl
- 30:21Discovered via Threat Hunting
- 31:09Investigation & Response
- 33:27Collect Forensics SaaS (& Cloud) Data
- 34:36Prepare an IR Team
- 36:57Apply What You Learned Today!
- 39:28RSAConference 2023
related talks
21m📙 The Room Where It Happens (Identity Compromise Edition): Behind the scenes of Okta attack campaigns 🔥
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
45mApplying Past Lessons for Intel-Driven Identity Threat Detection
55mAzure Attacks Unpacked: Real-World Threats & Lessons
48mThe Five Most Dangerous New Attack Techniques
52mLessons Learned from the Summer of Supply Chain Attacks
45mThe Cyberattack on Visma in 2018, experience sharing and views from the blue team
30mGetting Engagement in the Midst of Chaos