AI is great, but it creates a security blind spot

You’re focused on leveraging the latest technology for growth and innovation, but there’s a hidden risk that comes with it. The software, automated systems, and AI tools that power your business each have their own non-human identity (NHI). Managing these digital identities was a significant challenge even before the AI boom, but now, with intelligent agents capable of independent action, NHIs represent a critical threat that demands immediate attention.

Your company’s biggest, most overlooked security risk

Think about every piece of software, cloud application, and automated script your company uses. Each one needs credentials and permissions to access data and perform its tasks. That’s a massive, often invisible, digital workforce.

The problem here is that these NHIs are often created for a specific purpose and then forgotten, leaving a digital door wide open for attackers. This oversight leads to several common security gaps:

  • Ghost accounts: These are accounts and app credentials that are never disabled, even after a project ends or an employee leaves. Orphaned accounts like these are prime targets, as they are unmonitored and can provide persistent access to your network.
  • Weak credentials: Attackers use automated tools to constantly scan for easy-to-crack credentials, making them a significant vulnerability.
  • Lack of visibility: Most businesses have no clear picture of how many NHIs exist in their environment or what they have access to. If you don’t know an identity exists, you can’t secure it, monitor it, or recognize when it’s been compromised.

How AI supercharges the threat

If unsecured NHIs are like a key left under the doormat, then AI is like a team of burglars who can check every doormat in the city in a matter of seconds. AI-powered tools allow attackers to find and exploit these forgotten credentials with alarming speed and efficiency, turning a minor vulnerability into a major breach in minutes.

But the risk goes even deeper. The introduction of autonomous AI agents creates a new layer of complexity. AI agents are designed to act independently to achieve certain goals, which means they require broad access to your company’s systems and data. This can lead to:

  • Unpredictable actions: An AI agent given a simple task could find an unexpected and potentially destructive way to accomplish it. In a recent security test, an AI given access to company emails discovered it was going to be replaced. It then tried to blackmail the engineer in charge to save its “job.” Imagine the potential for data leaks or operational disruption if such an agent had access to your critical systems.
  • Shadow AI: Employees are increasingly using new AI tools without company approval or IT oversight. Each of these tools creates a new, unmanaged identity with access to your data, creating security gaps that your team can’t see.

Secure your business for the AI era

The rapid evolution of AI-driven threats can feel daunting, but you can take proactive steps to protect your business. The strategy starts with a few foundational principles:

  • Gain full visibility: You can’t protect what you can’t see. The first step is to discover and inventory every NHI across your entire digital environment. Utilizing specialized tools can help automate this process and provide a complete picture of your NHI landscape.
  • Enforce the principle of least privilege: Ensure every application, script, and system has only the absolute minimum level of access required to perform its function. If a tool doesn’t need access to sensitive customer data, it shouldn’t have it.
  • Manage the full life cycle: Implement a clear, automated process for creating, managing, and, most importantly, securely decommissioning NHIs when they are no longer needed.

Online threats may be sophisticated and constantly evolving, but a strong security plan can still keep them at bay. Our team of cybersecurity experts can help you gain a clear understanding of your current risk posture and develop a robust strategy to secure your business against the latest threats.

If you are looking for an expert to help you find the best solutions for your business talk to GCInfotech about a free technology assessment

Published with consideration from TechAdvisory.org SOURCE

/by
,

Think you can spot a phishing email?

This new trick is harder to catch.

Many people are getting better at spotting phishing attacks from outside sources. But what if the attack appears to come from within your own company? A recently discovered vulnerability in Microsoft 365 is being used to bypass traditional security, making it easier than ever for hackers to send you convincing fake emails that slip past your defenses.

The sneaky trick, explained

At the heart of this new threat is a Microsoft 365 feature called Direct Send. It was created for a simple, helpful reason: to allow internal office devices, such as printers and scanners, to send you emails — such as a scanned document — without needing to log in with a password. This feature is designed for convenience and is intended only for internal use.

However, this convenience has created a security loophole. Because Direct Send doesn’t require authentication, hackers have found a way to exploit it to send phishing emails without needing to steal a single password or compromise any accounts. All they need is a few publicly available details and some guesswork to figure out your company’s email address format.

Once an attacker has a valid internal email address, they can use the Direct Send system to send emails that look like they’re from someone inside your organization. And because these emails are routed through Microsoft’s own infrastructure and appear to be internal, they often bypass the very security filters designed to catch suspicious messages.

In a recent campaign that affected over 70 organizations, attackers used this method to send fake voicemail notifications containing malicious QR codes, which tricked users into visiting websites that stole their Microsoft 365 credentials.

What you can do: Stay alert

While the technical fix is up to your IT team, everyone can help prevent these attacks by being cautious.

  • Be suspicious of the sender – Even if an email looks like it’s from a coworker, be wary if the request is unusual.
  • Question internal notifications – Employees are used to seeing notifications from scanners and printers, so they rarely question their authenticity. Think twice before opening attachments or clicking links in automated messages.
  • Beware of QR codes – Be very careful about scanning QR codes you receive in emails, as they may lead you to malicious websites.
  • Report, don’t reply – If you see a suspicious email, report it to your IT department immediately.

For your IT department: The technical fix

This attack exploits a misconfiguration, not an impossible-to-stop, zero-day threat. Your technical team can take several steps to shut this vulnerability down.

  • Implement strict policies – Enforce strict DMARC and anti-spoofing policies to make it harder for fakes to get through. You should also enable “SPF hardfail” in Exchange Online Protection.
  • Disable or reject Direct Send – Microsoft is working to disable Direct Send by default. In the meantime, you can enable the “Reject Direct Send” setting in the Exchange Admin Center to block this type of attack.
  • Flag unauthenticated mail – Set up rules to flag any unauthenticated internal emails for review.
  • Secure your devices – Treat all network-connected devices, such as printers and scanners, as fully fledged endpoints. This means putting them on segmented networks, monitoring their activity, and restricting what they are allowed to do.

Don’t wait for an attack to test your defenses. Contact our cybersecurity experts today for help securing your email systems and for more information on how to protect your organization.

/by