Prevent Being a Downstream Victim of Service Provider Attacks

The number of downstream victim is increasing as attacks on service providers become more prevalent.

At the beginning of the year, several DigitalOcean customers received emails instructing them to reset their passwords, even though they hadn’t forgotten them. It was discovered that their email addresses had been compromised in a data breach, but the attack did not originate at DigitalOcean. Instead, it began from a MailChimp account.

DigitalOcean, like numerous other companies, depends on a third-party email service to send out email confirmations, password reset notifications, and alerts to its customers. Recently, an unauthorized individual accessed DigitalOcean’s Mailchimp account by exploiting MailChimp’s Internal Tooling. This enabled the cybercriminal to add an unapproved email address to the account and then pilfer the email addresses of DigitalOcean’s customers. It’s worth noting that accounts that had multi-factor authentication (MFA) enabled remained uncompromised. However, due to the security breach, DigitalOcean was unable to communicate with its customers for several days, which caused many people to express concerns about the safety of their personal information.

Even though the attack was initiated by a third-party organization, its impact was not limited to Mailchimp alone. Mailchimp suffered setbacks in its operations and lost customers as DigitalOcean switched to another email service provider. On the other hand, DigitalOcean faced a period of downtime during which it was unable to communicate with its customers, and this could have caused a loss of trust from its customers.

The MailChimp security breach is a clear illustration of an alarming trend. Frequently, security breaches not only affect the primary victim but also have a ripple effect on secondary victims. In this particular case, MailChimp was the primary target, while the customers of DigitalOcean became secondary victims. By aiming their attacks at key vendors, hackers can extend the reach of their attacks and inflict greater harm. Nonetheless, businesses can take measures to prevent themselves from becoming downstream victims.

Want to know more about Downstream Attacks? Visit our Cybersecurity course now.

Why Downstream Attacks are Increasing

As cybersecurity tools and techniques become more advanced, cybercriminals are forced to explore fresh methods to maximize the impact of their attacks. With a downstream attack, companies are often unable to rapidly identify the root cause of the breach. Sometimes, the breach goes unnoticed for days or even months. Alternatively, a downstream victim may become aware of the issue but find it challenging to trace its origin.

In addition, downstream attacks enable cybercriminals to amplify the extent of damage and disruption caused by a single attack. By targeting vendors who work with businesses that have a broad customer base, hackers can gain access to a significantly larger volume of customer data. As more companies adopt Software-as-a-Service (SaaS) solutions, vendors are becoming a more appealing target for cybercriminals due to the greater potential for downstream victims.

During a phishing attack, hackers were able to gain unauthorized access to Twilio’s customer engagement platform via its customer support console. With access to the platform, the cybercriminals were able to infiltrate Twilio’s customer base, which included Signal, a secure messaging service with roughly 40 million monthly users. As a result, 1,900 Signal users were impacted, and their phone numbers were compromised or their SMS verification codes were exposed. The most worrisome aspect of the attack is that the hackers were able to bypass Twilio’s multi-factor authentication (MFA) protocols to gain entry.

The surge in downstream victim attacks implies that companies must be vigilant not only about their own cybersecurity but also about the security of every other company they are linked with. This means that businesses are exposed to the risks of every vendor they work with. For instance, an organization that uses a cloud service provider, a customer relationship management (CRM) system, and an email marketing platform is only as secure as each of its vendors. As more companies rely on SaaS and digital tools, this risk is expected to escalate.

Steps to Avoid Becoming a Downstream Victim

Below are some methods to minimize the risk of your organization falling prey to a downstream attack:

• During vendor onboarding, perform a security audit. Your organization’s security is only as strong as that of your weakest vendor. Every time you engage in business with another company, you inherit their risk, and most importantly, you pass that risk on to your own customers.
• Request security-related contact details. Inquire about potential vendors’ security measures and procedures for informing customers following a breach. DigitalOcean encountered difficulty after the MailChimp breach when it was unable to contact MailChimp for information after being notified that its account had been disabled due to security concerns. Several organizations offer a dedicated support line or channel for addressing cybersecurity issues immediately.
• Contemplate implementing a zero-trust framework. By utilizing a zero-trust approach, your organization assumes that all apps, devices, and users attempting to gain access are unauthorized until their legitimacy is established. By combining this with micro-segmentation, which limits network access to the smallest possible section, you can decrease the extent of damage inflicted by a breach.
• Employ MFA (multi-factor authentication) on corporate accounts whenever possible. Ensure that all vendors your organization deals with provide MFA and mandate that employees use MFA on all vendor logins that are part of their job responsibilities. As evidenced by the DigitalOcean attack, MFA can prevent certain types of breaches. Although the Twilio attack demonstrated that MFA can still be compromised, the utilization of MFA can still considerably lessen the risk for organizations.
• Could you clarify what you mean by “backup plan for vendors”? Do you mean a plan to switch to an alternative vendor if the current vendor is disrupted, or something else?

Navigating Interconnected Risk

The proliferation of SaaS and PaaS has led to greater interconnectedness among companies. As service providers grant access to their clients, cybercriminals can now impact more individuals with a single attack. However, by recognizing the risk that each new vendor poses to your organization, you can take proactive measures to minimize any potential exposure and increase confidence that you are fulfilling your responsibility of safeguarding your customers’ privacy and data.

Here at CourseMonster, we know how hard it may be to find the right time and funds for training. We provide effective training programs that enable you to select the training option that best meets the demands of your company.

For more information, please get in touch with one of our course advisers today or contact us at training@coursemonster.com