[BreachExchange] Keeping up with the cybercriminals

[Audrey McNeil]

https://www.globalbankingandfinance.com/keeping-up-with-the-cybercriminals/

What do supermarkets, video games and search engines have in common? They
all belong to sectors that have seen major hacks over the last few years.
The cyberattacks on Tesco Banking, Sony and Yahoo, are just some of the
most public examples in demonstrating that the ‘hacker industry’ is
continuing to gather strength, attacking vulnerabilities in both the public
and private sector for profit.

>From corporate industries and political groups, to universities and
healthcare systems – even Twitter – no one is immune. And yet cyber
security is still misunderstood, or worse, underestimated. Cyber criminals
are becoming more creative; for each loophole we close or flaw we patch,
hackers continually are finding new methods to beat defences.

As I scan the cyber horizon looking for emerging threats, here are just a
few of the key areas at risk:

Web Applications:

Perhaps the area of highest risk, the threats to web applications are not
new but they are increasing. Worryingly, we are seeing more malware
targeted specifically at web applications, rather than aimed directly at
end points, such as devices or users.

The move towards cloud-based software means that more data than ever is
available through the web, presenting a potentially low friction access
point for hackers to gain entry to an organisation’s network.

Spear Phishing Attacks:

The second area that has seen a major increase is spear phishing attacks.
Far more dangerous than the general phishing scams that have been prevalent
since the mid-nineties, the new generation uses targeted attacks against
specific organisations. They often include malware tailored for the
victim’s organisation and which meet the hacker’s objective.

To illustrate, a spear phishing attack may include malware specifically
designed for a certain organisation’s end points, or some of the
capabilities and applications within the target victim’s environments.
These targeted attacks, when combined with the nature of the malware that’s
sent, can be even more damaging.

The Internet of Things:

Although a relatively new phenomenon, the Internet of Things (IoT) –
connected devices – is already being targeted by cyber criminals. There are
a growing number of applications that aren’t built from traditional
platforms, or unique commercial-off-the-shelf products (COTS) in the way
you would normally think of COTS products. Instead, they are one-offs
designed for a specific function and tend to have underlying systems that
are fairly unique and have received limited vulnerability testing.

In the recent past, the potential security vulnerabilities of IoT devices
were not a main concern. However, with more and more malware being
specifically designed to take advantage of the vulnerabilities of IoT
appliances and their capabilities to access a network, not to mention
botnets, IoT has quickly jumped up the CIO’s agenda.

Firmware:

Another area expected to see more attacks is at the firmware level. As
organisations have moved to the cloud, much of the malware that’s been
designed looks to attack within the container of the hosted tenant. For
instance, as the hosted tenant migrates their standard operating systems
and applications, the malware is deployed against those systems.

More attacks and malware specifically designed for one layer deeper are
expected at either the firmware or the orchestration layer. The
virtualisation layer could also be a target as it would potentially allow
an attacker to compromise more than just the single container. The risk of
such attacks has a massive impact on cloud vendors as well as other types
of hosting providers.

What’s a Company to Do?

Businesses need to approach the security of their environments in a
comprehensive manner, looking at every level of the technology stack to see
where a potential new or existing vulnerability could originate and/or be
exploited. Some of the proactive measures all organisations can follow to
guard against any form of cyberattack:

Implement a Defence in Depth model

Network edge security
Invest in Intrusion Detection and Prevention software
Install robust firewalls including Web Application Firewalls

Conduct regular vulnerability scans
Penetration testing

Safeguard VPN access

Adopt a virtual desktop environment for remote devices.

Block users from installing unauthorised applications

Insist on strong password controls for users

Adhere to basic security doctrines

Disable macro scripts

Implement proxy internet access

Segregate networks

Backup regularly and verify the integrity of those backups
Draw up an Information Security Policy
Create an education programme for users
Develop a practical incident response plan.

With so many moving parts and layers within the business, and so many
routes towards ensuring the security of environments, networks, and
applications, pairing with an expert security partner can help.  Not only
can this augment resources, it means you have an army of knowledge on your
side, ready to identify, take on and overcome the ever changing and
emerging threat-scape all companies face.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20161118/4d140ddd/attachment.html>