Secure your third-party application access

An attacker does not always need your password.

A trusted application already has access.

This week’s ConnectWise Cloud Backup™ incident highlights a risk every executive should understand: the permissions your enterprise grants to third-party software.

On October 21, Microsoft reported an AI-assisted campaign targeting hundreds of organizations.

In several cases, attackers gained privileged cloud access in less than three hours.

The activity began as early as September.

Microsoft linked the campaign to compromised ConnectWise application credentials.

Attackers used existing application permissions to enter customer environments without an interactive user sign-in.

More than 2,250 Microsoft 365 environments received attempted sign-ins. Attempts do not equal successful breaches or confirmed data theft.

My takeawayTreat third-party application access with the same discipline as privileged employee access.

Ask your security team:

• Inventory. Which external applications have access, and who owns each relationship?
• Permissions. Does each integration need every permission granted?
• Detection. Are we monitoring application activity alongside employee logins?
• Containment. Who has authority to disable a compromised connection?
• Verification. After containment, have we checked for additional credentials, permissions and persistent access?

My assessment: AI increases the urgency. Excessive permissions and unmonitored supplier access remain the underlying problems.

Your response plan needs to address both.

How quickly would your enterprise identify and contain a compromised supplier application?