Interviews

All hands on deck call

by Mark Rowe

There’s a widening gap between readiness and reality in cyber security perception, according to the IT and internet product company Cisco in its annual security report.

Businesses must adopt an ‘all hands on deck’ approach to defend against cyber attacks. Attackers have become more proficient at taking advantage of gaps in security to evade detection and conceal malicious activity. Defenders, namely, security teams, must be constantly improving their approach to protect their organization from these increasingly sophisticated cyber attack campaigns. These issues are further complicated by the geopolitical motivations of the attackers and conflicting requirements imposed by local laws with respect to data sovereignty, data localization and encryption.

Attackers

Cyber criminals are expanding their tactics and adapting their techniques to carry out cyber attack campaigns in ways that make it harder to detect and analyze. The top three trends last year that the company’s threat intelligence has identified are:

Snowshoe Spam: Emerging as a preferred strike method, attackers are sending low volumes of spam from a large set of IP addresses to avoid detection, creating an opportunity to leverage compromised accounts in multiple ways.

Web Exploits Hiding in Plain Sight: Widely used exploit kits are getting dismantled by security companies in short order. As a result, online criminals are using other less common kits to successfully carry out their tactics – a sustainable business model as it does not attract too much attention.

Malicious Combinations: Flash and JavaScript have historically been insecure on their own, but with advances in security detection and defenses, attackers have adapted by deploying exploits which combine their respective weaknesses. Sharing exploits over two different files – one Flash and one JavaScript – can make it more difficult for security devices to identify and block the exploit and to analyze it with reverse engineering tools.

Users

Users are caught in the middle. Not only are they the targets, but end-users are unknowingly aiding cyber attacks. Throughout 2014, Cisco threat intelligence research revealed that attackers have increasingly shifted their focus from seeking to compromise servers and operating systems to seeking to exploit users at the browser and email level. Users downloading from compromised sites contributed to a 228% increase in Silverlight attacks along with a 250pc increase in spam and malvertising exploits.

Defenders

Results from the Cisco Security Capabilities Benchmark Study, which surveyed Chief Information Security Officers (CISOs) and Security Operations (SecOps) executives at 1700 companies in nine countries sees a widening gap in defender perceptions of their likely security capabilities. Specifically, the study indicates that 75 per cent of CISOs see their security tools as very or extremely effective. However, less than 50% of respondents use standard tools such as patching and configuration to help prevent security breaches and ensure that they are running the latest versions. Heartbleed was the landmark vulnerability last year, yet 56pc of all installed OpenSSL versions are over four years old. That is a strong indicator that security teams are not patching.

While many defenders believe their security processes are optimized and their security tools are effective, in truth, their security readiness likely needs improvement, it is claimed. The report concludes that it’s time for corporate boards to take a role in setting security priorities and expectations. The Cisco “Security Manifesto”, a formal set of security principles as a foundation to achieving security, can help corporate boards, security teams and users in an organization better understand and respond to the cybersecurity challenges of today’s world. It can serve as a baseline for organizations as they strive to become more dynamic in their approach to security and more adaptive and innovative than adversaries. The principles are that security must –

support the business;
work with existing architecture – and be usable;
be transparent and informative;
enable visibility and appropriate action; and
be viewed as a “people problem”.

For a complete copy of the Cisco Annual Security Research report go to www.cisco.com/go/asr2015

Hacking industry

The evolving trends of mobility, cloud computing, and the Internet of Everything (IoE) present unparalleled opportunities for businesses, consumers, and hackers alike. At the same time, cyber attacks are increasingly sophisticated and discrete, driven by financial or political gain. In this rapidly changing threat landscape, security professionals face an era driven by new breed of highly motivated and well-armed adversaries.

So writes Martin Roesch on the ‘Industrialization of Hacking’. Visit cisco.com for the article in full.

Comment

Rob Lay, Solutions Architect for Enterprise and Cyber Security, UK & Ireland for Fujitsu, says of the Cisco report: “An all hands-on-deck approach is vital when it comes to security. Even the most sophisticated security technology cannot fully protect an organisation in today’s threat landscape. It must be part of a larger approach that includes an education programme to ensure all employees are aware of threats and know how to protect against them, and a security strategy which is aligned to the broader business strategy.

“As such, businesses should implement security education down to each individual employee so everyone understands their responsibility in keeping the business safe. Ensuring board level buy in and making sure that this is visible to all employees will also help to develop support and engagement for security programmes within the business. Understanding how security events actually impact and relate to the business is key in spotting a security incident early enough to defend against it. Due to the advanced nature of many of todays’ threats, an effective security education programme is vital in helping to identify and protect organisations appropriately.”

Related News

Newsletter

Subscribe to our weekly newsletter to stay on top of security news and events.

© 2024 Professional Security Magazine. All rights reserved.

Website by MSEC Marketing