Cisco recently released their Annual Security Report for 2015. Among the key findings were things like big shifts in the techniques of launching spam attacks to make them more difficult to filter, the rise in popularity of lesser known exploit kits, the trend of combining lesser exploits to cause bigger problems, and users becoming a much more preferred vector for attackers to leverage in order to achieve their endgame of infiltrating business networks.
Joe Caruso, the founder and CEO/CTO of Global Digital Forensics (GDF) has watched all of these trends play out repeatedly over the last year with real-world clients and says, “There is definitely nothing out of the blue in Cisco’s report, but I am glad they put such a strong focus on the user aspect of cyber security. In our experience as national cyber emergency responders, most successful attacks we encounter these days start with a malware-laden phishing email. Either they get a user to directly divulge credentials with a convincing letter, or they get them to open an attachment with an infected payload, or get them click on a link to a malicious site. From there it’s just a domino effect with grave consequences waiting at the end.”
Attackers have become more proficient at taking advantage of gaps in security to evade detection and conceal malicious activity. Defenders, namely, security teams, must be constantly improving their approach to protect their organization from these increasingly sophisticated cyber attack campaigns. These issues are further complicated by the geopolitical motivations of the attackers and conflicting requirements imposed by local laws with respect to data sovereignty, data localization and encryption.
Attackers
Cyber criminals are expanding their tactics and adapting their techniques to carry out cyber attack campaigns in ways that make it harder to detect and analyze. The top three trends last year that Cisco’s threat intelligence has identified are:
Users
Users are caught in the middle. Not only are they the targets, but end-users are unknowingly aiding cyber attacks. Throughout 2014, Cisco threat intelligence research revealed that attackers have increasingly shifted their focus from seeking to compromise servers and operating systems to seeking to exploit users at the browser and email level. Users downloading from compromised sites contributed to a 228% increase in Silverlight attacks along with a 250% increase in spam and malvertising exploits.
Defenders
Results from the Cisco Security Capabilities Benchmark Study, which surveyed Chief Information Security Officers (CISOs) and Security Operations (SecOps) executives at 1700 companies in nine countries* reveals a widening gap in defender perceptions of their likely security capabilities. Specifically, the study indicates that 75% of CISOs see their security tools as very or extremely effective. However, less than 50% of respondents use standard tools such as patching and configuration to help prevent security breaches and ensure that they are running the latest versions. Heartbleed was the landmark vulnerability last year, yet 56% of all installed OpenSSL versions are over four years old. That is a strong indicator that security teams are not patching.
While many defenders believe their security processes are optimized—and their security tools are effective—in truth, their security readiness likely needs improvement.
The report findings conclude that it’s time for corporate boards to take a role in setting security priorities and expectations.
You can download copy of the Cisco Annual Security Research report here. (registration required)