Cato Networks has unveiled the findings of its inaugural Cato CTRL SASE Threat Report for Q1 2024. The report shows that all organizations surveyed continue to run insecure protocols across their wide access networks (WAN), making it easier for cybercriminals to move across networks.
Developed by Cato CTRL, the SASE leader’s cyber threat intelligence (CTI) research team, the Cato CTRL SASE Threat Report Q1 2024 summarises findings gathered from the Cato SASE Cloud Platform traffic flows across Cato customers between January and March 2024. Cato CTRL analysed 1.26 trillion network flows and blocked 21.45 billion attacks.
Key findings include:
Enterprises are over trusting
- Once threat actors penetrate a network, they usually have less of a problem snooping critical data in transit across the network.
- All enterprises continue to run insecure protocols across their WAN, with 62% of all web application traffic being HTTP, 54% of all traffic being telnet, and 46% of all traffic being SMB v1 or v2 instead of SMBv3.
- Lateral movement – where attackers move across networks – was identified most frequently in the agriculture, real estate, and travel and tourism industries.
Zero-day problems are over-hyped
- Newly discovered vulnerabilities do not necessarily mean that the threats exploiting them are the most common. While zero-day threats earn much attention in the industry, threat actors often eschew the use of the latest vulnerabilities and instead exploit unpatched systems.
- When evaluating the top ten inbound common vulnerabilities and exposures (CVEs), the seven-year-old attack targeting the PHPUnit testing framework (CVE-2017-9841) was the most common found and it was found across 33% of the inbound CVE exploitations observed.
- Furthermore, three years after its discovery, Log4J (CVE-2021-44228) remains one of the most used exploits and it was found across 30% of the outbound CVE exploitations observed.
Many cyber threats are industry specific
- Of the observed media and entertainment organizations, 48% did not use one of 200+ applications identified by Cato CTRL as information security tools.
- The top three industries targeted with T1499 Endpoint Denial of Service techniques are entertainment, telecommunication, and mining & metals.
- In the services and hospitality sectors, threat actors utilise the T1212 Exploitation for Credential Access three times or more often than in other sectors.
