A busy week for technology specialists and a sobering week for cybersecurity.
Two critical vulnerabilities were disclosed in PHP, the technology underpinning a substantial proportion of the internet. Both received a CVSS severity score of 9.2 and could allow unauthenticated remote code execution. The NCSC warned organisations using PHP to assess whether they were affected and apply the relevant updates as quickly as possible.
At around the same time, the ConnectWise Cloud Backup incident presented a supply chain risk to many organisations.
Attackers obtained unauthorised access to application identities used to connect to customers’ Microsoft 365 environments. Because these applications had already been granted permissions within customer environments, the compromised identities could be used to target multiple organisations without requiring an interactive user login. ConnectWise subsequently disabled affected application identities and suspended services while it investigated.
Reporting on the incident also highlighted the use of AI-enabled automation, reinforcing the concern that attacks can now be conducted across many organisations at unprecedented speed.
These incidents are different, but they point in the same direction.
The window for defenders is getting smaller
Security teams have typically worked on the assumption that there will be at least some time between the disclosure of a vulnerability and its widespread exploitation. AI is challenging that assumption.
AI can help legitimate researchers review huge codebases, identify weaknesses and develop proof-of-concept exploits much faster. That is valuable work when it leads to responsible disclosure and patches. But the same capability is available to attackers, who can use automation to analyse patches, identify the underlying weakness and begin targeting exposed systems at scale.
Following the discovery of the PHP vulnerabilities, security leaders warned of a possible “vulnerability tsunami”, with AI increasing the pace at which weaknesses can be found and potentially exploited.
The ConnectWise incident illustrates the operational consequence. The concern is not simply that attacks are becoming more sophisticated. It is that activity can be automated across a large number of organisations at a speed that leaves defenders very little time to detect and contain it.
This makes security fundamentals more important
There is a temptation to view AI-enabled attacks as a problem requiring an equally futuristic product. Technology will certainly play an important role, but there is no single tool that makes an organisation secure. Resilience still depends on getting the fundamentals right, consistently:
- Knowing which systems, services and applications you depend upon.
- Maintaining an accurate inventory of assets and software.
- Patching according to exposure and risk, rather than relying solely on a fixed monthly routine.
- Monitoring privileged access, application identities and unusual authentication.
- Applying least privilege to users, administrators and third-party applications.
- Testing backups, incident response and recovery arrangements.
- Reviewing suppliers before and throughout the relationship.
- Understanding where sensitive data is held and who can access it.
- Training people to recognise and report suspicious activity.
- Giving security risks clear ownership at leadership level.
The supply-chain aspect deserves particular attention. A supplier may be trusted, but that does not mean every permission granted to its applications should be unlimited or permanent. Due diligence should examine data access, application permissions, security controls, incident-management arrangements and the consequences if that supplier is compromised.
That is where disciplines such as supplier assurance, Data Protection Impact Assessments and regular access reviews become practical security controls, not simply governance paperwork.
Good security needs to be part of everyday IT
For organisations without large internal security teams, these expectations can feel daunting. The answer is not to recreate the capability of a global enterprise. It is to make secure practice part of normal technology management.
That is the approach we take across Academia the Technology Group.
Security is not treated as a separate product added after an MSP service has been designed. It is incorporated into how environments are assessed, managed, monitored and continually improved.
Our approach draws on established frameworks and independently tested standards, including guidance from the NCSC, Cyber Essentials Plus, ISO 27001 and CIS benchmarks.
It is supported by in-house security and information-governance specialists, vulnerability management, security policy and risk management, staff awareness and structured data-protection and supplier assessments.
No MSP can promise that vulnerabilities or attacks will disappear. What a good MSP can do is help ensure that its customers have visibility of their risks, strong preventative controls, effective monitoring, a clear response process and people who know what to do when something changes.
Because in a world where vulnerabilities can be discovered and exploited faster than ever, peace of mind does not come from assuming your organisation will not be targeted. It comes from knowing that good security practice is already in place.
Find out more
You can read the official guidance about the recent incidents here:
Find out more about Academia’s cyber offerings or get in touch with an expert here.
Adam Monks
Group Technical Services Director
