Modern Kill Chains: Real World SaaS Attacks and Mitigation Strategies

The ubiquitous use of SaaS products has fundamentally changed the modern organization's attack surface. Organizations have moved critical business processes to SaaS tenants in search of agility, scalability and efficiency. In many cases, appropriate security controls have not followed. Attackers understand this change in attack surface and are increasingly taking advantage of the opportunity by targeting and breaching organizational SaaS tenants. This talk will primarily focus on novel research of threat actor activity on one of the largest collections of disparate SaaS log data in the world. The presenter will detail a variety of real world SaaS tenant attacks observed in the wild by known and unknown threat actors and discuss associated TTPs and IoCs. In addition to attack research data, we'll provide historical context to understand how we've arrived in this situation and propose mitigation strategies to protect organizations from these attacks.