trusted connection can potentially become a route an attacker tries to exploit.”
The ASOS incident reinforces the importance of securing employee identities, monitoring access to third-party systems and limiting the information available through compromised accounts.
It also demonstrates why organisations need to consider how a single compromised identity could affect multiple services within their wider technology environment.
Customer information and the risk of follow-on attacks
Although ASOS said payment card details and passwords had not been accessed, the potential exposure of names and contact information remained a concern.
Such information can be valuable to cybercriminals seeking to construct convincing phishing messages or impersonate legitimate organisations.
The publicity surrounding a high-profile breach can also provide an opportunity for criminals who were not involved in the original attack.
Wilson warned about this possibility when the incident first became public.
“ For customers, the biggest immediate risk may be what happens next. Criminals know people will be searching for information about the ASOS hack, and we would expect attempts to exploit that confusion.
WWW. INTELLIGENTCISO. COM 39