The demand for Digital Risk Protection (DRP) is on the rise as cybercriminals are increasingly targeting businesses on channels outside the corporate firewall. According to Frost Radar Global DRP Report, the traditional security perimeter has changed, and unlike phishing attacks that can be managed and mitigated through internal controls, these threats live on spaces not typically monitored by legacy security solutions. While larger industries are experiencing the brunt of malicious activity, threat actors are capitalizing on the unlimited and unchecked spaces throughout the attack surface to target industries previously lacking in the resources needed to protect their digital assets.
In this piece, we draw on insights from the Frost Radar Report to explore why DRP platforms are becoming a priority for businesses and share best practices for implementing a DRP strategy that organizations of all sizes can adopt.
Unlimited Attack Surface
According to the report, the dynamic nature of the threat landscape and the vast number of resources it takes to monitor, analyze, and mitigate phishing attempts make it impossible for organizations to protect their external attack surface without the help of a designated DRP platform. Getting started with DRP means implementing scalable processes that will aid in the collection of online threats wherever abuse may occur. It also means the constant fine-tuning of curated analyses that will support complete mitigation. Security playbooks solely focused on threats targeting the corporate firewall will fail to address external threats.
The increased use of external channels and platforms by businesses for brand building has led to a vast online environment where digital assets are vulnerable to impersonation and abuse. There is no defined space where abuse may occur, and a lack of understanding around what assets exist and where they might be exposed can lead to financial loss and brand disruption. Because of this, there are a wide range of use cases that apply to DRP, and it is essential security teams know which apply to their organization.
DRP use cases include, but are not limited to:
- Domain monitoring
- Social media protection
- Brand protection
- Account takeover protection
- Data leak protection
- Executive protection
Collection
Attack volume and targets across external spaces has changed significantly in the post-pandemic world. Response-based email phishing attacks, once led by costly business email compromise and advance-fee email scams, have been surpassed in volume by hybrid vishing attacks that incorporate mobile devices into traditional phishing campaigns. Even the makeup of victims on the Dark Web have shifted, with compromised data tied to smaller institutions such as Credit Unions showing a steady increase in volume. Underground incidents associated with Credit Unions have increased every quarter for five consecutive quarters.
Because of the broad scope of where digital assets may live, one of the greatest challenges to implementing DRP is collecting sufficient intelligence. Threats may live on multiple channels, with attacks incorporating more than one device. Frost Global Security Research Team advises DRP platforms should be capable of monitoring a wide range of resources including:
- Surface web
- Dark web
- Social channels
- Blogs
- Data feeds
- Third-party feeds
To detect threatening behavior effectively, security teams should continuously gather intelligence from these and other relevant channels. Because collection can be extensive, it should combine both human expertise and automated systems wherever possible. Effective methods may include a mix of free and paid data feeds, third-party sources, pivoting techniques, anti-evasion strategies, and more.
Curation
According to the Frost Radar Report, a critical element of effective DRP is the ability to transform raw data into actionable insights connected to an organization’s external digital footprint. Human analysis plays a vital role in evaluating potential threats. With efficient curation, security teams can significantly reduce a threat’s lifespan. Ultimately, the more compelling the evidence of malicious activity, the greater the likelihood that the threat will be promptly taken down.
This process can be both challenging and time consuming if an organization is gathering a high volume of data through their collection methods. In order to ease that burden, curation should include a combination of both expert human review and technology. Risk-scoring algorithms should be used to aid in the processing of data and remove false positives. Analysts should then validate those results, add context, and proceed with actioning the threat.
Mitigation
The primary goal of a DRP program is to swiftly mitigate harmful content. Because different types of threats require tailored responses, rapid and comprehensive curation is essential for effective mitigation.
Mitigation should focus on three objectives:
- Removing the threat in entirety from the infrastructure it lives on
- Blocking access to the threat
- Integrating with internal security controls
Because there is no set process to mitigating external threats, security teams should be prepared to move forward with multiple approaches including incorporating takedown APIs, killswitch integrations, and browser-blocking. The odds of a successful mitigation are significantly increased through communication with network providers. Nurturing those relationships will enhance a security team’s ability to have threats removed in a timely manner.
Frost analysts note that as organizations conduct more virtual interactions on unconventional channels, the risk of phishing attacks that impersonate their brand or executive has increased significantly. These attacks are more frequently occurring outside the protection of corporate firewalls, making it difficult for security teams to mitigate threats through legacy solutions. In order to find and stop these threats before a brands integrity is compromised, DRP solutions that incorporate robust collection, curation, and mitigation strategies should be adopted.
Interested in learning more about Fortra Brand Protection's DRP service? Schedule a demo.
