Mass Data Breaches: Beyond Authentication
Mass Data Breaches: Enhancing Authentication for a New Era of Fraud
The reason is simple. To gain access to large volumes of information, cybercriminals no longer necessarily need to exploit a sophisticated vulnerability or bypass existing security controls. In many cases, they simply use valid credentials and behave like legitimate users.
This shift represents a fundamental change in attack patterns. For years, organizations have focused their efforts on protecting the perimeter and detecting technical attacks. Today, the risk is moving inside the applications themselves, beyond the point of authentication.
Less technical attacks, but often more effective
Many of yesterday’s major data breaches relied on exploiting application vulnerabilities. SQL injection is one of the best-known examples: by manipulating queries sent to a database, an attacker could extract large amounts of information they should never have been able to access.
This type of attack has not disappeared, but it is no longer always the preferred route. Cybercriminals increasingly understand that it is often easier to use a legitimate account than to bypass a security control.
Once logged in with valid credentials, they can query an application at very high speed to collect as much information as possible. In some cases, the privileges associated with the account are sufficient on their own. In others, simply modifying a parameter in a URL or navigating through insufficiently segmented functionality can provide access to significant volumes of data.
This approach is all the more dangerous because, on the surface, it looks like normal activity.
How do fraudsters obtain this access?
Credential theft remains a widely used method, but it is no longer the only one.
We are also seeing growing human-related risks. Some criminal networks are now seeking legitimate access directly from individuals who have the necessary permissions. This can involve bribing employees or contractors, who are paid to make their access available, as well as blackmail or extortion targeting employees in sensitive roles.
In all cases, the result is the same: to the organization’s systems, the fraudster appears to be an authenticated and authorized user.
And that is precisely where the challenge lies. Security tools have traditionally been designed to detect someone attempting to gain access without authorization. They are far less effective when the malicious individual already has a legitimate identity.
Why traditional defenses are reaching their limits
Adding new security controls at the code level requires development cycles, testing and validation processes that may not align with the urgency of the risk. When dealing with legacy applications or solutions provided by third-party vendors, such changes may even be impossible in the short term.
This is one of the reasons Web Application Firewalls (WAFs) have become an essential layer of protection. Their role is to help analyze incoming requests in order to identify known attack signatures or abnormal behavior.
However, a WAF is primarily designed to detect suspicious requests. When a legitimate user performs technically valid actions, nothing may appear unusual. The syntax is correct, authentication is valid, and requests comply with expected rules. From the WAF’s perspective, everything looks normal.
That is precisely what makes these attacks so difficult to detect.
Shifting the focus from access to behavior
The challenge is therefore no longer simply to verify whether a user has the right to access a system. It is also essential to understand what they do once they are logged in.
This approach is well established in the world of fraud prevention. For years, specialized platforms have sought to determine not only who is performing an action, but also whether that action is consistent with observed patterns and behaviors.
Solutions such as LexisNexis® ThreatMetrix® [CD1.1]make it possible to monitor behavior in near real time and help detect significant deviations from the typical patterns associated with a user or device. Without requiring major changes to existing applications, organizations can measure in near real time the volume of actions performed by an account or machine across rolling time windows ranging from a few minutes to several weeks.
Consider a simple example. An employee typically accesses around ten records a day. If they suddenly access several thousand records within a few hours, the system can flag this behavioral deviation and automatically trigger an alert, an additional verification step or a block.
Analysis can also be performed at the device level. This capability is particularly valuable when a fraudster attempts to distribute activity across multiple accounts in order to remain below traditional detection thresholds.
The next challenge for cybersecurity and fraud prevention
For a long time, cybersecurity has focused on one essential question: Who is trying to get in? As threats evolve, a new question is becoming increasingly important: What is that person actually doing once they are logged in? Organizations that continue to base their strategy solely on authentication and perimeter protection risk missing the most subtle and difficult-to-detect incidents. By contrast, organizations that incorporate behavioral analytics inspired by fraud prevention will gain an additional capability to help identify anomalous activity, even when it originates from perfectly legitimate identities. Because today, the doors are often well locked.
The real challenge is detecting those who already have the key.