Summer of Security Risks: What the Recent Wave of Zero-Days Tells Us

It seems we survived the holiday weekend without a notable security breach.   This summer has seen a wave of newly discovered zero-day vulnerabilities, which hackers have already exploited before being patched. The number of zero-day vulnerabilities found in 2023 has already surpassed last year’s totals, at 57, over last year’s 52.    The rise in zero days is partly due to cybercriminals catching on to their allure, as they become easier to access on the cybercriminal underground.

But it’s not only the new hotness to worry about.  According to Qualys, 15 of the 20 most exploited software vulnerabilities are in Microsoft’s code, with the top vulnerability being a six-year-old memory corruption bug in Microsoft Office that has been used as recently as August 31.

And our favorite, attacks on the help desk and IT department are still considerable.   Hackers are using social engineering to reset multifactor authentication for highly privileged Okta enterprise accounts, gaining access to the cloud-based identity access management service and moving laterally through targeted networks. US-based customers of Okta have reported a “consistent pattern” of “cross-tenant impersonation” attacks in recent weeks, with the actors targeting users assigned with “Super Administrator” permissions, the company revealed in a recent blog post.

IBM’s 2023 Cost of a Breach report shows that the average cost of a breach rose to $4.45 million, with costs associated with escalation and detection increasing 42% over the last three years. Only 51% of breached entities surveyed by IBM decided to bolster their security investments despite the rising financial consequences of dealing with a breach.

It’s popular to think security is the route to profit for IT providers.     I will observe that the basics are still missing for so many.      A combination of patch management, backups, and user social engineering defense goes very far.   But let’s celebrate the good weekend.