Protect SaaS Data From Brute Force Attacks - SaaS Alerts

In the current world, a vast majority of a company’s sensitive data resides in Software as a Service (SaaS) applications like Office 365, Google Workspace, Salesforce, Dropbox, etc.

In the recent 2020 State of SaaSOps report by BetterCloud, their data suggests that 85% of all application usage by 2025 will be via SaaS. For those who’re an MSP or IT service provider reading this, they should be thinking, “Oh snap!!! What can I be doing to better protect the sensitive data in these applications?”

‘Brute force attacks’

Users need to understand the methods being used to compromise the data

First, in order to protect the data, users need to understand the methods being used to compromise the data. One of the methods bad actors are using to gain access to the data living in these SaaS applications is ‘brute force attacks’. 

What is a brute force attack? A brute force attack, also known as an exhaustive search, is a cryptographic hack that relies on guessing possible combinations of a targeted password until the correct password is discovered.

SaaS Alerts platform

At SaaS Alerts, they are currently processing nearly one million SaaS application events per day and they can see that brute force attacks are on the increase. In fact, in a 7-day period, almost every end user company on the SaaS Alerts platform has seen at least one brute force attack. 

Since 2017, it’s estimated that 5% of brute force attempts have been successful at gaining access to SaaS applications. While that percentage might seem low, the absolute number is very large based on the total number of attempts.

Need for MSPs to enhance cybersecurity

An MSP might be asking, “Is this activity important to be aware of?” For those who are interested in protecting themselves and their customers, then the answer is “positively 100% YES!” Ninety two percent of MSPs use and resell Office 365, the most popular SaaS application for business in the world and it happens to be the most vulnerable.

George Kurtz slammed Microsoft in the context of the SolarWinds breach investigation

In a recent infosecurity article, CrowdStrike CEO, George Kurtz slammed Microsoft in the context of the SolarWinds breach investigation, saying hackers were able to exploit Microsoft’s overly complicated and ‘antiquated’ architecture.

George Kurtz stated, “The threat actor took advantage of systemic weaknesses in the Windows authentication architecture, allowing it to move laterally within the network and reach the cloud environment, while bypassing multifactor authentication.”

What can an MSP do to protect themselves and their customers?

• Step 1, start monitoring SaaS applications -because they can’t manage what they don’t measure/monitor.
• Step 2, actively use the information from a SaaS monitoring tool to remediate critical alerts and start adding more value to their client relationships.
• Step 3, start charging an incremental fee for the added protection.

Now, specifically what can an MSP do if their client is hit with a brute force attack?

Key cybersecurity measures to prevent attacks

Contact the customer or user and make them aware of this event. This event indicates a possible account compromise by an unauthorized actor due to repeated login failures within a minimal timeframe.

It is recommended to reset the password to a complex password, and enable MFA if not already enabled. If the attack persists, then consider deleting the account and reissue a new user account with new credentials with MFA enabled. Lastly, continue to monitor the SaaS environment on an ongoing basis for unusual user behavior.