Privilege elevation vulnerabilities are the most common vulnerabilities exploited by internal company employees when performing unauthorized activities on networks, either with malicious intent or by downloading dangerous tools.
See also: USA – ransomware attacks 2022: Who was affected?
A report from Crowdstrike, based on data collected from January 2021 to April 2023, shows that insider threats are increasing and that exploitation of Privilege elevation vulnerabilities is a significant element of unauthorized activity.
According to the report, 55% of internal threats recorded by the company are based on Privilege elevation exploitation, while the remaining 45% are due to negligence that introduces risks through downloading or abusing tools.
Internal violators usually turn their backs on their employer because they have been given financial incentives, due to disappointment or due to differences with their supervisors.
CrowdStrike also classifies incidents as internal threats when they are not malicious attacks against a company, such as the use of exploits to install software or conduct security testing.
However, in these cases, although they are not used to attack the company, they are usually used at risk, possibly introducing threats or malware into the network that malicious users can abuse.
See also: Ransomware: Attacks increase by over 200%
CrowdStrike found that attacks originating within targeted organizations cost an average of $648,000 for malicious and $485,000 for non‑malicious cases. These numbers may be even higher in 2023.
In addition to the significant financial cost of insider threats, Crowdstrike highlights the indirect impact on a company’s image and reputation. According to Crowdstrike, exploiting privilege elevation vulnerabilities to gain administrative privileges is critical to many insider attacks, as in most cases, insider attackers start with access to their network environments.
Privilege elevation allows attackers to perform actions such as downloading and installing unauthorized software, deleting logs, or even diagnosing problems on the computer using tools that require administrator privileges.
See also: These are the largest DDoS attacks ever carried out worldwide
One of the main preventive measures to take to address Privilege elevation exploits is to implement strict security policies. These policies should include limited access to sensitive resources and strict management of user access rights.
Another important preventive measure is the awareness and training of users. Users must be aware of the risks of Privilege elevation exploits and know how to recognize and address threats.
Furthermore, strengthening the security of user accounts is vital for preventing privilege escalation exploits. This includes using strong passwords, multi-factor authentication, and regular password changes.
Finally, updating and applying security updates and patches is essential to prevent privilege escalation exploits. Security updates must be installed regularly and vulnerabilities must be fixed immediately once discovered.
Source: bleepingcomputer
