入口ごとに、実際に使われた攻撃の経路と推奨の 3 手

For all cloud deployment types, you own your data and identities. You're responsible for protecting the security of your data and identities, on-premises resources, and the cloud components you control.

出典を開く確認 2026-09-26

Responsibility area On-premises IaaS PaaS SaaS Customer data Customer Customer Customer Customer Configurations and settings Customer Customer Customer Customer Identities and users Customer Customer Customer Customer Client devices Customer Customer Customer Shared Applications Customer Customer Shared Shared Network controls Customer Customer Shared Microsoft Operating system Customer Customer Microsoft Microsoft Physical hosts Customer Microsoft Microsoft Microsoft Physical network Customer Microsoft Microsoft Microsoft Physical datacenter Customer Microsoft Microsoft Microsoft

出典を開く確認 2026-09-26

お客様は、データの管理 (暗号化オプションを含む)、アセットの分類、IAM ツールでの適切な権限の適用について責任を負います。

出典を開く確認 2026-09-26

基盤となるネットワークとインフラストラクチャについてはクラウド プロバイダが常に責任を負います。お客様はアクセス ポリシーとデータについて常に責任を負います。

出典を開く確認 2026-09-26

When organizations face attacks against their AWS environments, misuse of AWS IAM user access keys continue to account for a large majority of initial attack vectors

出典を開く確認 2026-09-26

Where possible, we recommend relying on temporary credentials instead of creating long-term credentials such as access keys.

出典を開く確認 2026-09-26

Security Hub CSPM recommends that you remove all access keys that are associated with the root user.

出典を開く確認 2026-09-26

Security Hub CSPM recommends that you remove or deactivate all credentials that were unused for 90 days or more.

出典を開く確認 2026-09-26

S3 general purpose buckets should have block public access settings enabled

出典を開く確認 2026-09-26

Threat actors exploited third-party software-based entry (44.5%) more frequently than weak credentials—a significant increase from the 2.9% observed in H1 2025. While weak or absent credential entry fell from 47.1% in H1 to 27.2% in H2, software exploitation overtook credentials as the primary initial access vector for the first time.

出典を開く確認 2026-09-26

Defensively, organizations should pivot from manual patching to automated defenses—such as patching the Web Application Firewall (WAF)—to neutralize exploits at the network edge before software updates can be applied.

出典を開く確認 2026-09-26

Mitigate the risk of human error by deploying an Organization Policy that blocks overly permissive firewall rules and prohibits 0.0.0.0/0 ingress configurations.

出典を開く確認 2026-09-26

このような組織のポリシーの例としては、サービス アカウント キーの作成の無効化やサービス アカウント キーのアップロードの無効化が挙げられます。

出典を開く確認 2026-09-26

IP アドレスを指定し、ウェブコンテンツのオリジナルデータが保存されているオリジンサーバを直接標的にすることで、アクセスの分散によって負荷軽減を実現している CDN (Contents Delivery Network)を回避する攻撃が複数の事案で確認された。

出典を開く確認 2026-09-26

Explicitly block all traffic that does not come from Cloudflare IP addresses

出典を開く確認 2026-09-26

rotate your origin IPs, as DNS records are in the public domain. Historical records are kept and would contain IP addresses prior to joining Cloudflare

出典を開く確認 2026-09-26

Cloudflare Free Managed Ruleset: Available on all Cloudflare plans. Provides protection against high-impact and widely exploited vulnerabilities.

出典を開く確認 2026-09-26

感染経路 2022年 2023年 2024年 2025年 ① VPN機器 61.8% 63.5% 55.0% 66.3% ② リモートデスクトップ 18.6% 18.3% 31.0% 20.7%

出典を開く確認 2026-09-26

You're opening your PC up to the internet, which isn't recommended. If you must, make sure you have a strong password set for your PC. It's preferable to use a VPN.

出典を開く確認 2026-09-26

You're opening your PC up to the internet, which isn't recommended. If you must, make sure you have a strong password set for your PC. It's preferable to use a VPN.

出典を開く確認 2026-09-26

Most routers allow you to define which source IP or source network can use port mapping. So, if you know you're only going to connect from work, you can add the IP address for your work network - that lets you avoid opening the port to the entire public internet.

出典を開く確認 2026-09-26

被害組織へのアンケート結果によると、侵入経路は VPN（Virtual Private Network）機器が６割以上を占める状況である。

出典を開く確認 2026-09-26

攻撃者は、未修正のぜい弱性、漏えいした認証情報や簡易なパスワード、設定不備等を悪用して組織のネットワークへ侵入する。

出典を開く確認 2026-09-26

However, we recommend all customers to upgrade to one of these recommended versions regardless.

出典を開く確認 2026-09-26

(Best) Remove administrative access to your FortiGate from internet-facing interfaces and instead manage it via an internal or out-of-band method.

出典を開く確認 2026-09-26

Treat all configuration as potentially compromised and follow the recommended steps below to recover

出典を開く確認 2026-09-26

Implement MFA on all administrator and VPN user accounts

出典を開く確認 2026-09-26

Based on Mandiant Incident Response (IR) and Mandiant Threat Defense (MTD) engagements from H2 2025, our analysis found that threat actors exploited identity issues to gain initial access in 83% of the incidents involving major cloud and SaaS-hosted environments.

出典を開く確認 2026-09-26

Based on our learnings more than 99.9% of those common identity-related attacks are stopped by using multifactor authentication and blocking legacy authentication. Our goal is to ensure that all organizations have at least a basic level of security enabled at no extra cost.

出典を開く確認 2026-09-26

管理者と主要ユーザーには 2 段階認証プロセスを義務付けてください。

出典を開く確認 2026-09-26

Enforce phishing-resistant MFA using physical hardware keys or FIDO2-compliant passkeys.

出典を開く確認 2026-09-26

The implementation of phishing-resistant multifactor authentication (MFA) can stop over 99% of this type of attack even if the attacker has the correct username and password combination.

出典を開く確認 2026-09-26

Configure user consent settings to allow users to only consent to applications that meet certain criteria.

出典を開く確認 2026-09-26

In AWS, 59% of IAM users have an active access key older than one year. Over half of these users have credentials that have been unused for over 90 days

出典を開く確認 2026-09-26

AWS purposefully denies specific actions rather than completely disabling the compromised access key or user password. However, this decision allows advanced threat actors to use the exposed credentials for any actions the policy does not explicitly deny.

出典を開く確認 2026-09-26

CISA analysis determines that applying the Cisco-provided security updates required by the original issuance of ED 25-03 does not necessarily remove an existing threat actor from the compromised device.

出典を開く確認 2026-09-26

Review firewall and VPN users and other configuration for unauthorized changes.

出典を開く確認 2026-09-26