Quarter of Fortune 500’s External IT Assets Are a Cyber Risk

Quarter of Fortune 500’s External IT Assets Are a Cyber Risk

The external attack surface of Fortune 500 companies contains known, exploitable vulnerabilities and security issues, according to new research from Cyberpion.

360 Mobile Vision - 360mobilevision.com North & South Carolina Security products and Systems Installations for Commercial and Residential - $55 Hourly Rate. ACCESS CONTROL, INTRUSION ALARM, ACCESS CONTROLLED GATES, INTERCOMS AND CCTV INSTALL OR REPAIR 360 Mobile Vision - 360mobilevision.com is committed to excellence in every aspect of our business. We uphold a standard of integrity bound by fairness, honesty and personal responsibility. Our distinction is the quality of service we bring to our customers. Accurate knowledge of our trade combined with ability is what makes us true professionals. Above all, we are watchful of our customers interests, and make their concerns the basis of our business.

The Israeli startup compiled its findings from a “single-pass scan” of the public and internet-facing assets of every Fortune 500 company in the first half of 2021.

Nearly three-quarters (73%) of these organizations’ IT infrastructure is now located externally, but this outsourcing trend appears to have created a significant visibility gap. Some 24% of these assets are considered risky or have a known vulnerability, Cyberpion claimed.

This includes a quarter (25%) of externally hosted cloud-based assets that failed at least one security test, such as misconfigured storage.

The report also claimed that the average Fortune 500 firm has 126 different login pages for customers and employees — but 10% of these allow data transmission over unencrypted HTTP or have invalid certificates.

Fortune 500 firms also connect to an average of 951 cloud assets, but almost 5% of these are vulnerable to severe abuse, Cyberpion claimed. This includes AWS buckets misconfigured, which could allow hackers to read or overwrite customer data or code.

The vendor warned that attackers could take advantage of these gaps in visibility and protection to launch Magecart-style attacks, DNS hijacks or brand abuse — resulting in financial and reputational damage.

“Security teams often can’t effectively defend against attacks stemming from third parties because they lack visibility into the total inventory and volume of assets they are connected to,” said Cyberpion CEO Nethanel Gelertner.

“They are unaware of the exposure to these external vulnerabilities and can’t identify and mitigate against these risks. In addition, the growth of these interconnected assets continues to explode due to trends in cloud-first architectures and digital transformation initiatives, meaning that assessing and protecting the attack surface has become even more challenging over time.”

By admin