Article: Pen-Test Results Hint at Improvements in Enterprise Security

Article: Pen-Test Results Hint at Improvements in Enterprise Security

Article: Pen-Test Results Hint at Improvements in Enterprise Security 1090 728 Andrew Hay

In a recent DarkReading interview by Jai Vijayan, Lares CEO Chris Nickerson provided insight into how organizations are making it more difficult for attackers to succeed.

From the article:

“I won’t say that the days of ‘point, click, and exploit’ are over, but they sure are rare,” says Chris Nickerson, CEO at pen-testing firm Lares. While security hardening, hygiene, patch management, password quality, and lack of visibility continue to remain big challenges, security organizations are evolving, he notes.

Increasingly, attackers are being forced to change their tactics and employ malware-less, “living-off-the-land” approaches to hide their malicious activity. “It is rare that ‘exploitation’ is the first hook into the environment anymore,” Nickerson says. “Now tools and technology are required to observe normal system functions to determine if they are being used maliciously.”

Lares recently analyzed data from hundreds of pen-test engagements to see what similarities it could find across enterprise networks. The results showed that accounts with weak and easily guessable passwords continue to be the biggest problem for most organizations. Other common vulnerabilities and attack vectors include weaknesses related to Kerberos authentication, excessive file system permissions, Window Management Interface (WMI)-enabled lateral movement, inadequate network segmentation, and improper access control.

You can read the full article here: https://www.darkreading.com/threat-intelligence/pen-test-results-hint-at-improvements-in-enterprise-security/d/d-id/1337591.

Where There is Unity, There is Victory

[Ubi concordia, ibi victoria]

– Publius Syrus

Contact Lares Consulting logo (image)

Continuous defensive improvement through adversarial simulation and collaboration.

Email Us

©2024 Lares, a Damovo Company | All rights reserved.

Error: Contact form not found.

Error: Contact form not found.

Privacy Preferences

When you visit our website, it may store information through your browser from specific services, usually in the form of cookies. Some types of cookies may impact your experience on our website and the services we are able to offer. It may disable certain pages or features entirely. If you do not agree to the storage or tracking of your data and activities, you should leave the site now.

Our website uses cookies, many to support third-party services, such as Google Analytics. Click now to agree to our use of cookies or you may leave the site now.