{"id":327482,"date":"2024-08-22T09:30:35","date_gmt":"2024-08-22T16:30:35","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=327482"},"modified":"2024-08-22T09:29:21","modified_gmt":"2024-08-22T16:29:21","slug":"incident-response-by-the-numbers","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2024\/08\/incident-response-by-the-numbers\/","title":{"rendered":"Incident Response by the Numbers"},"content":{"rendered":"

<\/a>Key Insights from Unit 42\u2019s 2024 Incident Response Report<\/h2>\n

In the past year, we\u2019ve seen threat actors making bigger moves faster to mount more sophisticated attacks against their targets.<\/p>\n

As we helped hundreds of clients assess, respond and recover from attacks, we collected data about those attacks and compiled them into our 2024 Incident Response (IR) Report<\/a>.<\/p>\n

Here are the data points that tell the story of last year's attacks and the steps defenders can take to protect their organizations.<\/p>\n

<\/a>To Block Attacks, Lock Down the Vectors<\/h2>\n

Attack vectors are the avenues by which attackers penetrate your organization\u2019s defenses. Understanding how attackers get in can show you where to place controls to stop them.<\/p>\n

The three most popular initial attack vectors we identified:<\/p>\n

    \n
  1. Software and API vulnerabilities: 38.6% of cases<\/li>\n
  2. Previously compromised credentials: 20.5% of cases<\/li>\n
  3. Social engineering and phishing: 17% of cases<\/li>\n<\/ol>\n

    Shoring up these weak points is no easy task, and it requires a combination of tools, expertise and routine processes.<\/p>\n

    <\/a>Exploiting Software and API Vulnerabilities<\/h3>\n

    Last year, software and API vulnerabilities provided the initial access vectors for 38.6% of attacks we investigated \u2013 more than any other vector.<\/p>\n

    These attacks result from large-scale, automated intrusion campaigns. Often, attacks targeted key parts of the software supply chain, like Apache\u2019s Log4j logging framework and Oracle\u2019s WebLogic server, affecting governments, banks, shipping companies, airlines and others.<\/p>\n

    The IR Report demonstrates that these types of exploits are not anomalies. Instead, they represent an attack trend. A proactive patch management program<\/a> is key to addressing realized vulnerabilities promptly and anticipating future vulnerabilities based on trends and threat intelligence.<\/p>\n

    The challenge lies in an uncomfortable truth \u2013 vulnerabilities are discovered at a far greater rate than teams\u2019 ability to patch them. Thousands of vulnerabilities are reported each year<\/a>, and each patch should be tested before being deployed in your environment.<\/p>\n

    Two of the top five Common Vulnerabilities and Exposures (CVEs)<\/a> exploited in 2023 were identified years before that (2020 and 2021), which illustrates a significant lag in patching known vulnerabilities.<\/p>\n

    <\/a>Detecting vulnerabilities isn\u2019t enough. Teams must be able to prioritize the most critical vulnerabilities and implement defenses to mitigate lower-priority vulnerabilities. <\/strong><\/h5>\n

    <\/a>Continued Use of Previously Compromised Credentials<\/h3>\n

    Previously compromised credentials provided the initial access vector in 20.5% of cases we investigated \u2013 a 5x rise over the past two years.<\/p>\n

    Compromised credentials overtook phishing and social engineering as an attack vector, and there is a persistent and active black market for them.<\/p>\n

    Good hygiene can limit the damage potential of stolen credentials, but controls must go beyond strong passwords and multifactor authentication (MFA).<\/p>\n