While increases in malware are clearly a major threat to both enterprises and service providers, network complexity is creating its own vulnerabilities, according to a maiden security report from Ixia.
The research conducted by Enterprise Management Associates for Ixia found that the average enterprise is using six different cloud services and network segmentation is increasing.
However, 54% of enterprises are monitoring less than half of those segments and less than 19% of companies believe that their IT teams are adequately trained on the wide array of network appliances they are managing.
“Organizations need to constantly monitor, test, and shift security tactics to keep ahead of attackers in the fast-paced threat landscape we all deal with today. This is especially important as new cloud services and increased IoT devices are routinely being introduced,” said Steve McGregory, senior director of Application Threat Intelligence at Ixia.
“To do this effectively, organizations must start by studying their evolving attack surface and ensure they have the proper security expansion measures in place. Simple but effective testing and operational visibility can go a long way to improving security.”
Gaining access to accounts is often done the old-fashioned way—brute force guessing starting with the obvious, as many network accounts and devices contain default usernames and passwords. The passwords topping the list included favorites like “admin,” “123456,” “support,” and “password.”
Also, the top exploited URI paths used for brute force WordPress logins were /xmlrpc.php and /wp-login.php. Across customers, Ixia’s ATI Research Center also saw many attempts to scan for the phpinfo() function and that most URIs attempted for attack were PHP based.
Further, top phishing targets identified by the ATI Research Center included Facebook, Adobe, Yahoo! and AOL logins. Adobe updates were the most prevalent drive-by updates for delivering malware or phishing attacks.
“Understanding your network breadth across physical, virtual, and cloud assets is critical to protecting it,” said Jeff Harris, VP of security solutions at Ixia. “We anticipate that network visibility into every segment, IoT monitoring, and AI will be some of the key security topics in 2017.”