Business Challenge Story

Security breaches continue to be a problem in every industry across the globe, and the costs of breaches are rising. While artificial intelligence (AI) has many benefits for businesses, it has also created new vulnerabilities that cybercriminals can exploit to carry out complex cyberattacks that are difficult to detect and mitigate. Using AI, hackers can create convincing phishing emails that bypass spam filters. Similarly, cybercriminals can leverage AI to manipulate security systems and gain unauthorized access that causes irreparable damage to your business and your reputation.

Cyberthreats are prevalent and growing and can target any organization, large or small. In such a scenario, the absence of enterprise-level protection puts small businesses at a significant disadvantage. Without the help of a managed security service provider, keeping your private data secure can be complicated, expensive, and risky.

Incident Description

While completing an Azure Sign-In logs audit for our customer, we noticed an unauthorized successful login on a user's account. After checking with the user and going through the login logs, we saw there were multiple login-attempts to the account from different locations. The IT team checked the Audit Logs for 1 month prior and determined the most likely cause of the breach to be a phishing email that the user had opened and clicked on few days back. The logs showed the details of the first successful login attempt to the user’s account from a fraudulent location, and the authentication was processed via a “KeepMeSignedIn” token in a browser.

This suggests the most likely cause of the breach may have been a hijacked browser token when the user clicked on the Phishing link.

We performed subsequent analyses of the Audit logs and did not see any indication of data exfiltration from the system. Additionally, a Dark Web scan against the user’s email account was performed, and nothing was detected. The IT team also verified in the sign-in logs that subsequent login attempts from unknown locations had been failing.

Incident Resolution

The identification and quick actions taken by the IT team to safeguard the user’s account have proven very effective in preventing any further access by the bad actors. Additional considerations were also put in place to assist with identifying and mitigating potential issues going forward.

Incident Recommendation

The IT team recommended the following going forward:

  1. Enforce MFA authentication methods for Microsoft 365 to only be accessible via the Microsoft Authentication App with Number Matching.
  2. Implementation of Data Loss Prevention policies in the environment.
  3. Implementation of more stringent BYOD policy.
  4. Implementation of regular/ongoing Cyber Security Monitoring and Auditing Tools in the environment.

Prevent the unexpected from ruining your company’s security. Find out more about how Aura’s Cybersecurity-as-a-service can benefit your company. Contact us today.

We’re ready to
work for you.

HEAD OFFICE

1742 10 Ave SW, Calgary, AB T3C 0J8

403-269-6123 option 2

info@auraadvanced.com

  • This field is for validation purposes and should be left unchanged.