脆弱性 2 は、SMITTEN メトリックに従って、悪用可能であり、悪用アクティビティが高く、外部に公開されているため、優先する必要があります。参照: 脆弱性管理メトリック: プログラムで測定を開始する 5 つのメトリック、セクション: 脆弱性の重大度。

The most likely attack that was performed is CSRF (Cross-Site Request Forgery). This is an attack that forces a user to execute unwanted actions on a web application in which they are currently authenticated1. If the user has several tabs open in the browser, one of them might contain a malicious link or form that sends a request to the web application to change the user's password, email address, or other account settings. The web application will not be able to distinguish between the legitimate requests made by the user and the forged requests made by the attacker. As a result, the user will lose access to their account.
To prevent CSRF attacks, web applications should implement some form of anti-CSRF tokens or other mechanisms that validate the origin and integrity of the requests2. These tokens are unique and unpredictable values that are generated by the server and embedded in the forms or URLs that perform state-changing actions. The server will then verify that the token received from the client matches the token stored on the server before processing the request. This way, an attacker cannot forge a valid request without knowing the token value.
Some other possible attacks that are not relevant to this scenario are:
* RFI (Remote File Inclusion) is an attack that allows an attacker to execute malicious code on a web server by including a remote file in a script. This attack does not affect the user's browser or account settings.
* LFI (Local File Inclusion) is an attack that allows an attacker to read or execute local files on a web
* server by manipulating the input parameters of a script. This attack does not affect the user's browser or account settings.
* XSS (Cross-Site Scripting) is an attack that injects malicious code into a web page that is then executed by the user's browser. This attack can affect the user's browser or account settings, but it requires the user to visit a compromised web page or click on a malicious link. It does not depend on having several tabs open in the browser.

技術的制御により、デジタル空間における機密性、整合性、可用性が強化されます。技術的セキュリティ制御の例には、ファイアウォール ルール、アクセス制御リスト、侵入防止システム、暗号化などがあります。

特権アカウントから観察されたアクティビティは、信頼できるユーザーまたは従業員がアクセス権を悪用して組織のセキュリティを侵害する内部者攻撃を示しています。電子メールや機密情報へのアクセス、監査ログの変更、異常な時間でのログインはすべて、データを盗んだり、改ざんしたり、破壊したり、痕跡を隠そうとしている可能性のある、特権ユーザーによる悪意のある行動の兆候です。内部者攻撃は、組織の評判、運用、コンプライアンスに重大な損害を与える可能性があります12。
参考資料: 特権ユーザー アカウントの管理ガイド、特権ユーザーのアクティビティを Active Directory で追跡する方法