What is a Brute Force Attack and What to Do When They Happen?

How to Prevent and Identify a Brute Force Attack

We live in a world where a vast majority of a company’s sensitive data resides in Software as a Service (SaaS) applications like Office 365, Google Workspace, Salesforce, Dropbox, etc. In the recent 2020 State of SaaSOps report by BetterCloud, their data suggests that 85% of all application usage by 2025 will be via SaaS. If you’re an MSP or IT service provider reading this, you should be thinking, “oh snap!!! What can I be doing to better protect the sensitive data in these applications?”

First, in order to protect the data, you need to understand the methods being used to compromise the data.  One of the methods bad actors are using to gain access to the data living in these SaaS applications is “brute force attacks”.  What is a brute force attack? A brute force attack, also known as an exhaustive search, is a cryptographic hack that relies on guessing possible combinations of a targeted password until the correct password is discovered.

At SaaS Alerts we are currently processing nearly one million SaaS application events per day and we can see that brute force attacks are on the increase. In fact, in a 7-day period, almost every end user company on the SaaS Alerts platform has seen at least one brute force attack.  Since 2017, it’s estimated that 5% of brute force attempts have been successful at gaining access to SaaS applications. While that percentage might seem low, the absolute number is very large based on the total number of attempts.

If you are an MSP you might be asking, “is this activity important to be aware of?” If you are interested in protecting yourself and your customers, then the answer is “positively 100% YES!” Ninety two percent of MSPs use and resell Office 365, the most popular SaaS application for business in the world and it happens to be the most vulnerable. In a recent infosecurity article, CrowdStrike CEO, George Kurtz slammed Microsoft in the context of the SolarWinds breach investigation, saying hackers were able to exploit Microsoft’s overly complicated and “antiquated” architecture.

“The threat actor took advantage of systemic weaknesses in the Windows authentication architecture, allowing it to move laterally within the network and reach the cloud environment while bypassing multifactor authentication.” said Kurtz.

What can an MSP do to protect themselves and their customers?

Step 1, start monitoring SaaS applications -because you can’t manage what you don’t measure/monitor.

Step 2, actively use the information from a SaaS monitoring tool to remediate critical alerts and start adding more value to your client relationships.

Step 3, start charging an incremental fee for the added protection.

Now, specifically what can an MSP do if their client is hit with a brute force attack?

Contact the Customer or User and make them aware of this event. This event indicates a possible account compromise by an unauthorized actor due to repeated login failures within a minimal timeframe. It is recommended to reset the password to a complex password, and enable MFA if not already enabled. If the attack persists, then consider deleting the account and reissue a new user account with new credentials with MFA enabled. Lastly, continue to monitor the SaaS environment on an ongoing basis for unusual user behavior. If you’re interested in a full list of remediation recommendations for SaaS based cybersecurity events, please email marketing@saasalerts.com