A new study warns that the vast majority of organizations still struggle with security hygiene and posture management, and 69% of organizations admit they had experienced at least one cyberattack that started through the exploit of an unknown or unmanaged internet-facing asset, including software, cloud-based workloads, user accounts, and IoT devices.

The study, conducted by the Enterprise Strategy Group on behalf of JupiterOne, found that 86% of organizations believe they follow best practices for security hygiene and posture management. However, 70% of organizations say they use more than 10 security tools to manage security hygiene and posture management, which raises concerns about data management and operations overhead.

“The data demonstrates that many organizations continue to address security hygiene and posture management tactically on a technology-by-technology basis,” said Jon Oltsik, principal analyst and ESG Fellow, who wrote the report. “ESG believes that CISOs should take a more holistic approach to security hygiene and posture management by adopting technologies and processes for discovering assets, analyzing data, prioritizing risks, automating remediation tasks, and continuously testing security defenses at scale.”

In a dramatic, but unsurprising finding, some 73% of security professionals admit they still depend on spreadsheets to manage security hygiene and posture at their organizations. As a result, 70% of respondents say that security hygiene and posture management had become more difficult over the past two years as their attack surfaces have grown.

With cloud migration and business agility as the strategy of the decade, it’s not terribly surprising that most organizations have lost control over what their internet-facing perimeter consists of, said Oliver Tavakoli CTO at Vectra. “The ease with which developers can stand up new services and expose them to the internet is one of the realities of the epoch we find ourselves in,” Tavakoli said.

Jake Williams, co-founder and CTO at BreachQuest, said for several years, we’ve known that hardware and software inventory are the pillars of a cohesive security architecture. That’s why hardware and software inventory have been No. 1 and No. 2 on the prioritized list of CIS Critical Security Controls for as long as anyone can remember, Williams said.

“Given the ease with which assets can be provisioned in cloud environments, it’s no surprise that many of those assets end up constituting an unmanaged attack surface,” Williams said. “Many organizations provision cloud assets from images they did not build themselves, such as using base images from Docker Hub. Because they didn’t build the original image, they are often unaware of the underlying software components and as such fail to perform adequate vulnerability management.”

Bud Broomhead, CEO at Viakoo, said as the attack surface has shifted to unmanaged and IoT devices, the traditional IT approaches simply don’t work. Broomhead said it’s not the number of tools used, it’s whether they are the right tools, and many organizations are just beginning to deploy patching, certificate, and password solutions that can work with both unmanaged and IoT devices.

“It’s not surprising that 69% majority of organizations have experienced an incident, but without using cyber hygiene solutions specifically designed for unmanaged and IoT devices, these numbers will continue to grow,” Broomhead said.

John Bambenek, principal threat hunter at Netenrich, added that it isn’t surprising that so many organizations were breached because of an unknown or unmanaged internet-facing resources.

“The legacy of DevOps and agile development has been little if any security review, much less change control, before things ship to production,” Bambenek said. “When engineers tout innovation under the mantra of ‘go fast and break things’ that’s exactly what happens. But on the bright side, I have unlimited job security, so there’s that.”

A major new cyber-attack named as KnockKnock has been detected currently taking place against Office 365 Exchange Online email accounts, according to Skyhigh Networks.

The cloud security firm is reporting that more than half of its customers are being attacked from 16 different countries. The interesting thing about this attack is that it’s not targeting humans or their ‘human’ accounts, but rather machines. Under attack are corporate accounts, not tied to any human identity, which thus lack the usual advanced security measures such as two-factor authentication or recurring password reset.

The attacks started in May and are still ongoing, although Skyhigh says the bulk of attack happened in the summer months between June and August. So far, 63 different networks and 83 IP addresses have been used for the attacks.

Skyhigh has notified the affected parties and said that no data loss has been spotted.

“Normally, login attacks follow the ‘brute force’ template with widespread attempts made simultaneously across hundreds of corporate accounts, but KnockKnock reveals that more precise tactics are being deployed,“ commented Nigel Hawthorn, chief European spokesperson at Skyhigh Networks.

“By intelligently targeting accounts not linked to users, the attempts are far less likely to be red flagged or noticed by security, particularly if only one or two attempts are made at any one time; three failed login attempts often sets of alarm bells – just think about what happens to your phone if you forget your pin.”

“Businesses rely on a variety of tools that work together to produce a holistic cloud infrastructure but these connections require the creation of accounts that aren’t linked to a specific user. If companies don’t fully understand how their infrastructure works, hacker entry into one system could have a domino effect. For example, if actors manage to force entry into email accounts which, in turn, are linked to CRM or accounting solutions, suddenly an even bigger pool of corporate and customer data is at risk.”

“To ensure such accounts are awarded the same attention as other network vulnerabilities, firms must not only be aware of which and how systems are linked, but have the ability to monitor long-term login and user activity, so that attacks like KnockKnock are flagged.”

The world’s largest container shipping biz has revealed the losses it suffered after getting hit by the NotPetya ransomware outbreak, and the results aren’t pretty.

The malware surfaced in Ukraine in June after being spread by a malicious update to MeDoc, the country’s most popular accounting software. Maersk picked up an infection that hooked into its global network and shut down the shipping company, forcing it to halt operations at 76 port terminals around the world.

“In the last week of the quarter we were hit by a cyber-attack, which mainly impacted Maersk Line, APM Terminals and Damco,” CEO Soren Skou said in a statement today.

“Business volumes were negatively affected for a couple of weeks in July and as a consequence, our Q3 results will be impacted. We expect that the cyber-attack will impact results negatively by USD 200-300m.”

Admittedly Maersk is massive – it’s responsible for around 15 per cent of the world’s entire shipping network – but that kind of financial damage is close to a record for such an attack. Then again, the company’s entire network was down for days, Skou told the Financial Times.

“It was frankly quite a shocking experience,” said Skou. “Your email goes down, all your address system. We ended up having to use WhatsApp on our private phones. Most business problems, you will have an intuitive idea on what to do. But with this and my skills, I had no intuitive idea on how to move forward.”

Skou said that he decided to take personal charge of the situation, sitting in on IT meetings and getting daily updates on the malware’s progress. He says he learned that there was nothing that could have been done to stop the attack, but he wants to strengthen the company’s systems against further attacks.

Maersk wasn’t the only multinational to be hit by NotPetya. WPP, the world’s largest advertising agency, also took a major hit, as did deliveries firm TNT. While the latter biz hasn’t responded to requests for comment it’s understood to have taken weeks to sort out its infection with a permanent loss of data.

Microsoft’s security team is urging developers to shore up their software update systems – after catching miscreants hijacking an editing application’s download channels to inject malware into victims’ PCs.

In a security advisory, Redmond’s infosec gurus describe Operation WilySupply: their mission to find, isolate and destroy an unusual and highly targeted form of malicious code that was hiding in the software update mechanism of a widely used, and unnamed, editing tool.

Microsoft thinks that the attackers found a flaw in the application’s upgrade system that allowed them to send unsigned updates to Windows machines to install. A 132-byte binary called ue.exe was dispatched to some victims’ computers: this fired off PowerShell scripts and Meterpreter to fetch and run the Rivit trojan.

This wasn’t the usual spray-and-pray malware attack. The initial infection via this update channel was highly selective and only affected specific computers run by finance and payment companies. After it had delivered the payload, the ue.exe program instantly deleted itself to avoid detection.

“While the attack itself, including the selection of targets, appears to have been carefully planned, the attacker toolset comprised commodity tools and simple malware,” the advisory states. “These commodity tools are the same tools used in typical penetration testing exercises.”

Microsoft believes the purpose of the attack was to siphon organizations’ cash into crooks’ pockets, which would account for the camouflage techniques. The Windows giant has now added routines to detect similar infections to its operating system’s antivirus tools.

However, it’s going to be up to software developers to truly lock down this method of attack. Redmond recommends fully encrypting supply channels, enforcing code signing, perhaps adding two-factor authentication for critical stuff, and checking logs frequently.

The Barts Health NHS Trust is a system of three district general hospitals staffing over 15,000 employees serving 2.5 million patients in east London.

The Health Service Journal reports that the attack affected thousands of files hosted on the hospital group’s Windows XP operating system, and the file sharing system between departments has been turned off, according to the Telegraph.

Last year, ransomware attacks against Northern Lincolnshire and Goole Hospitals forced them to shut down systems and cancel operations for four days.

They were infected with a variant known as Globe2, which commonly infects users via phishing emails containing malicious links, according to ZDNet.