More than half of all attempted unauthorized logins originate from just five countries, according to a new report from cybersecurity firm SaaS Alerts.
The report’s authors say that 53% of all attempted unauthorized logins originated from China, Vietnam, India, Brazil, and Korea.
Cybersecurity firm SaaS Alerts released the finding as part of its third annual SaaS Application Security Insights (SASI) Report, which offers a detailed look at the major threat vectors and security gaps that exist in SaaS Application security targeting small businesses.
Among the report’s other key findings:
- On average, there were approximately 40,000 brute attacks per day against user accounts monitored by SaaS Alerts.
- 2022 saw a 61% increase in the rate of phishing attacks compared with 2021. The study also revealed that cybercriminals shifted their attacks to mobile and personal communication channels to reach users, and showed a 50% increase in attacks on mobile devices, with scams and credential theft at the top of the list of payloads.
- Outside approved locations accounted for over 55% of the most common critical alerts and occurred when there was a successful login to a user account from outside of an approved location or an approved IP address range. While this alert can be a false flag due to misconfiguration of approved locations or unexpected user travel, it is a serious alert, indicating a significant probability that a malicious actor has succeeded in compromising an account.
- Salesforce and Slack generated the most critical alerts on a per-user/per-alert basis. Of all logged Salesforce events, over 8% of those events were critical alerts compared to 3.77% for Slack, 1.82% for Google Workspace, and 1.26% for Office 365.
- Compared to last year’s data, the report found a 29% increase in the number of guest user accounts, which can have access to sensitive data and open access points for bad actors. Of the over 979,840 SaaS accounts monitored by SaaS Alerts in 2022, 54% were from guest user accounts versus licensed users.
Increasing SaaS Application Adoption
The report was created through an analysis of the SaaS application security records of 7,400-plus SMBs and nearly 1 million end-user accounts in 2022.
SaaS Alerts’ report examines the inherent issues and complexities regarding the accelerated rate of SaaS Application adoption and concerns with cybersecurity threats and gaps from external threats such as hackers and internal insider threats caused by employee or contractor negligence, misconfiguration of SaaS App security controls, unsafe cybersecurity practices, and human error.
Jim Lippie, CEO, SaaS Alerts, commented on the findings:
“By moving from legacy systems to the cloud, businesses can realize increased productivity and quickly scale their operations. While the pandemic accelerated the adoption of SaaS solutions, this trend continues today and is rapidly growing. However, as we’re seeing with increasing frequency as threat actors become more sophisticated in their methods and tactics, businesses face new and unprecedented challenges with data theft, data-at-risk, and bad actors when integrating with the most popular SaaS Applications and MSP tools. Our report offers an in-depth analysis as businesses of all sizes across the globe face mounting internal and external threats, and provides valuable insights to help organizations preemptively protect themselves from falling victim to the next attack.”
SaaS Alerts’ Alert Monitoring
The report presents some interesting details about the platform tools that MSPs use and how many alerts they generated over the course of the year.
SaaS Alerts currently offers the ability for MSPs to monitor several of their own internal tools including IT Glue, NinjaOne, ConnectWise Automate, and Kaseya VSA. On average, the company says it monitors 15-30 different events per MSP tool.
There are a fixed number of events that the company monitors for and the total number is now up to 254. There are 3 settings: Low, Medium, and Critical. MSPs can set a customized alert threshold for each event.
“For example, if a certain 'high risk' employee exceeds 25 GB of data downloaded out of OneDrive, an MSP can determine that event is a 'Critical Alert.' However, there could be other employees that are allowed to download 300 GB of data,” explains Lippie.
SaaS Alerts recently helped one managed service provider identify a possible Chinese spy ring at a U.S. manufacturing company.
