Businesses face threats from every direction. Many think they’re safe from nation-state attackers, but the truth is, no organization is immune to security risks.
Security leaders must stay informed about the latest threat intelligence. This can come from internal resources or third-party providers. By grasping the tactics used by threat actors, organizations can put strong systems in place to analyze and act on this information effectively.
Creating an informed organizational culture is crucial. Leaders need to educate employees about common threats and appropriate responses. This proactive approach serves as a first line of defense.
One of the most common attack methods is social engineering. To combat this, companies should implement processes that reduce the chance of individual breaches. Strategies like phishing-resistant authentication, strict identity governance, and robust incident response capabilities are essential.
However, securing one’s own operations isn’t enough. In the past, nation-state actors have exploited vulnerabilities in third-party suppliers and supply chain governance. Building solid supply chain governance is now critical, and businesses must grasp the access and dependencies their suppliers have.
If a breach occurs, threat actors often aim for lateral movement within systems. That’s why having tools like endpoint detection and response, along with zero-trust solutions to block unauthorized access, is vital.
In 2023, attackers stole 1.9 billion session cookies from Fortune 1000 employees. With these tokens, they can bypass multi-factor authentication, making detection and response trickier. Organizations need solutions within a zero-trust framework to identify attempts to replay session tokens. This can help prevent further credential or endpoint compromises.
Collaboration among organizations and within industries is essential. By working together, businesses can better understand these threats, the risks posed by nation-state actors, and how to develop stronger defenses.
Stephen McDermid is the EMEA Chief Security Officer at Okta.