{"id":13771,"date":"2017-07-25T08:30:27","date_gmt":"2017-07-25T06:30:27","guid":{"rendered":"http:\/\/www.intelligentcio.com\/africa\/?p=13771"},"modified":"2017-07-25T08:30:27","modified_gmt":"2017-07-25T06:30:27","slug":"cisco-2017-midyear-cybersecurity-report-predicts-new-destruction-of-service-attacks","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/africa\/2017\/07\/25\/cisco-2017-midyear-cybersecurity-report-predicts-new-destruction-of-service-attacks\/","title":{"rendered":"Cisco 2017 Midyear Cybersecurity Report predicts new ‘destruction of service’ attacks"},"content":{"rendered":"

The Cisco\u00ae 2017 Midyear Cybersecurity Report (MCR) uncovers the rapid evolution of threats and the increasing magnitude of attacks, and forecasts potential ‘destruction of service’ (DeOS) attacks. These could eliminate organisations\u2019 backups and safety nets, required to restore systems and data after an attack. Also, with the advent of the Internet of Things (IoT), key industries are bringing more operations online, increasing attack surfaces and the potential scale and impact of these threats.<\/p>\n

Recent cyber incidents such as WannaCry and Nyetya show the rapid spread and wide impact of attacks that look like traditional ransomware, but are much more destructive. These events foreshadow what Cisco is calling ‘destruction of service’ attacks, which can be far more damaging, leaving businesses with no way to recover. <\/p>\n

The Internet of Things continues to offer new opportunities for cybercriminals, and its security weaknesses, ripe for exploitation, will play a central role in enabling these campaigns with escalating impact. Recent IoT botnet activity already suggests that some attackers may be laying the foundation for a wide-reaching, high-impact cyberthreat event that could potentially disrupt the Internet itself.<\/p>\n

\u201cAs recent incidents like WannaCry and Netya illustrate, our adversaries are becoming more and more creative in how they architect their attacks. While the majority of organisations took steps to improve security following a breach, businesses across industries are in a constant race against the attackers. Security effectiveness starts with closing the obvious gaps and making security a business priority,\u201d said Steve Martino, Vice President and Chief Information Security Officer, Cisco.<\/p>\n

Measuring effectiveness of security practices in the face of these attacks is critical. Cisco tracks progress in reducing ‘time to detection’ (TTD), the window of time between a compromise and the detection of a threat. Faster time to detection is critical to constrain attackers\u2019 operational space and minimise damage from intrusions. Since November 2015, Cisco decreased its median TTD from just over 39 hours to about 3.5 hours for the period from November 2016 to May 2017. This figure is based on opt-in telemetry gathered from Cisco security products deployed worldwide.<\/p>\n

\u201cComplexity continues to hinder many organisations\u2019 security efforts. It\u2019s obvious that the years of investing in point products that can\u2019t integrate is creating huge opportunities for attackers who can easily identify overlooked vulnerabilities or gaps in security efforts. To effectively reduce TTD and limit the impact of an attack, the industry must move to a more integrated, architectural approach that increases visibility and manageability, empowering security teams to close gaps,\u201d said Scott Manson, Cyber Security Leader for Middle East and Turkey, Cisco.<\/p>\n

Threat landscape: what\u2019s hot and what\u2019s not<\/strong><\/p>\n

Cisco security researchers watched the evolution of malware during the first half of 2017 and identified shifts in how adversaries are tailoring their delivery, obfuscation and evasion techniques. Specifically, Cisco saw they increasingly require victims to activate threats by clicking on links or opening files. They are developing fileless malware that lives in memory and is harder to detect or investigate as it is wiped out when a device restarts. Finally adversaries are relying on anonymised and decentralised infrastructure, such as a Tor proxy service, to obscure command and control activities. <\/p>\n

While Cisco has seen a striking decline in exploit kits, other traditional attacks are seeing a resurgence: <\/p>\n

\u2022\tSpam volumes are significantly increasing, as adversaries turn to other tried-and-true methods, like email, to distribute malware and generate revenue. Cisco threat researchers anticipate that the volume of spam with malicious attachments will continue to rise while the exploit kit landscape remains in flux. <\/p>\n

\u2022\tSpyware and adware, often dismissed by security professionals as more nuisance than harm, are forms of malware that persist and bring risks to the enterprise. Cisco research sampled 300 companies over a four month period and found that three prevalent spyware families infected 20% of the sample. In a corporate environment, spyware can steal user and company information, weaken the security posture of devices and increase malware infections. <\/p>\n

\u2022\tEvolutions in ransomware, such as the growth of Ransomware as a Service, make it easier for criminals, regardless of skill set, to carry out these attacks. Ransomware has been grabbing headlines and reportedly brought in more than $1 billion in 2016, but this may be misdirecting some organisations, who face an even greater, under-reported threat. Business email compromise (BEC), a social engineering attack in which an email is designed to trick organisations into transferring money to attackers, is becoming highly lucrative. Between October 2013 and December 2016, $5.3 billion was stolen via BEC, according to the Internet Crime Complaint Center.<\/p>\n

Unique industries face common challenges<\/strong><\/p>\n

As criminals continue to increase the sophistication and intensity of attacks, businesses across industries are challenged to keep up with even foundational cybersecurity requirements. As Information Technology and Operational Technology converge in the Internet of Things, organisations struggle with visibility and complexity. As part of its Security Capabilities Benchmark Study, Cisco surveyed close to 3,000 security leaders across 13 countries and found that across industries, security teams are increasingly overwhelmed by the volume of attacks. This leads many to become more reactive in their protection efforts.<\/p>\n

\u2022\tNo more than two-thirds of organisations are investigating security alerts. In certain industries (such as healthcare and transportation), this number is closer to 50%.
\n\u2022\tEven in the most responsive industries (such as finance and healthcare), businesses are mitigating less than 50% of attacks they know are legitimate.
\n\u2022\tBreaches are a wake-up call. Across most industries, breaches drove at least modest security improvements in at least 90% of organisations. Some industries (such as transportation) are less responsive, falling just above 80%.<\/p>\n

Important findings per industry include<\/strong>:<\/p>\n

\u2022\tPublic sector \u2013 Of threats investigated, 32% are identified as legitimate threats, but only 47% of those legitimate threats are eventually remediated.
\n\u2022\tRetail \u2013 32% said they\u2019d lost revenue due to attacks in the past year with about one-fourth losing customers or business opportunities.
\n\u2022\tManufacturing \u2013 40% of the manufacturing security professionals said they do not have a formal security strategy, nor do they follow standardised information security policy practices such as ISO 27001 or NIST 800-53.
\n\u2022\tUtilities \u2013 Security professionals said targeted attacks (42%) and advanced persistent threats, or APTs (40%), were the most critical security risks to their organisations.
\n\u2022\tHealthcare \u2013 37% of the healthcare organisations said that targeted attacks are high-security risks to their organisations.<\/p>\n

Cisco\u2019s advice for organisations<\/strong><\/p>\n

To combat today\u2019s increasingly sophisticated attackers, organisations must take a proactive stance in their protection efforts. Cisco Security advises: <\/p>\n

\u2022\tKeeping infrastructure and applications up to date, so that attackers can\u2019t exploit publicly known weaknesses.
\n\u2022\tBattle complexity through an integrated defence. Limit siloed investments.
\n\u2022\tEngage executive leadership early to ensure complete understanding of risks, rewards and budgetary constraints.
\n\u2022\tEstablish clear metrics. Use them to validate and improve security practices.
\n\u2022\tExamine employee security training with role-based training versus one-size-fits-all.
\n\u2022\tBalance defence with an active response. Don\u2019t ‘set and forget’ security controls or processes. <\/p>\n

For the 2017 MCR, a diverse group of 10 security technology partners were invited to share data from which to jointly draw threat landscape conclusions. Partners that contributed to the report include Anomali, Flashpoint, Lumeta, Qualys, Radware, Rapid7, RSA, SAINT Corporation, ThreatConnect and TrapX. Cisco\u2019s security technology partner ecosystem is a key component of the company\u2019s vision to bring security that is simple, open and automated to customers. <\/p>\n