Garrett Hamilton

As rules are altered, controls drift from baselines and risk gets buried in the rulebase. Stale firewall rules stay live, shadowed rules obscure exposure, and overly permissive any/any rules sneak in. Periodic manual rule reviews rarely add value and fail to validate live enforcement posture. Months pass between audits, widening the gap for AI adversaries to exploit weaknesses and breach defenses. In fact, 42% of all configuration-related breaches, or near misses, are due to firewall rule misconfigurations. Reach continuously finds and fixes these weaknesses before AI attackers can exploit them.

The Microsoft Defender Security Research Team and Microsoft Threat Intelligence documented a campaign in which Storm-2949 abused Microsoft Entra ID accounts to exfiltrate data from Microsoft 365 and Azure environments. The attack path depended on a chain of security control gaps across identity, SharePoint access, endpoint protection, application control, and event visibility. Each misconfigured security control gave the attackers an opening and more room to move after the initial identity compromise. We took a closer look at the security controls mapped directly to the steps that Storm-2949 actually executed, and how proper configuration could have likely thwarted forward progress for Storm-2949.

This growing issue not only increases an organization’s exposure to potential cyberattacks but also wastes money and time spent by security analysts chasing down alerts that could have been stopped upstream. By understanding the implications of security debt and implementing strategies for security hardening, organizations of all sizes can minimize risk and maximize their return on investment.