McAfee Labs: "2016 Threats Predictions"

The trend: This year, attacks against popular applications, large enterprises and government agencies, payment systems, and cloud services platforms will increase. A most common method used by the attackers is through stealing crucial information from individual consumers and employees: Cybercriminals first steal customers' user names and passwords through phishing or keylogging, or they hack employees' home systems or insecure networks in hotels, then they use the stolen information to breach a corporate database to steal personal information including credit cards, social security numbers, and addresses of millions of individuals. Once the attackers have obtained the data, they sell it as quickly as possible and pocket the profits.

In this 39-page long paper by McAfee Labs, several major security threats are predicted for 2016:

• Application vulnerabilities are an ongoing problem for software developers and their customers. Adobe Flash, Internet Explorer, and increasingly, embedded systems, the Internet of Things, and infrastructure software will become the targets for advanced threats and zero-day attacks.
• Payment system cybercriminals will increasingly focus on attacks that lead to the theft and sale of credentials. They will leverage traditional, time-proven mechanisms including phishing attacks and keystroke loggers, and they will target the consumers directly because they are both the source of the credentials and the weakest link in the payment process. New attack methods will emerge too. And the number of payment system thefts will continue its relentless growth.
• Attacks against large enterprises and governmental agencies will continue. Research indicates that the number of attacks continues to grow. In 2016, we should expect to see at least one, if not more, major attacks that start with an employee-owned system or a company system that is in an insecure location such as a hotel or coffee shop. And Android devices also serve as a gateway into secure environments for malware or advanced persistent threats.
• Cybercriminals, nefarious competitors, vigilant justice seekers, and nation-states will increasingly target hacking into cloud services platforms to exploit companies and steal valuable and confidential data, using it for competitive advantage, or financial or strategic gain.

McAfee's Recommendations:

This threat should lead to IT organizations taking a hard look at what it means to be secure. It isn’t enough to worry about security only on your company’s network. Smart organizations need to expand their protection into the homes of their employees. If an organization has the latest technology installed with smart people in place to create effective policies and remain vigilant, attackers have few options.

Verizon Data Breach Report has identified 10 most common security incidents of the past 10 years, including the attack patterns, hacking techniques and common missteps in security measures designed to prevent data leakage and theft. In addition to the 1,367 confirmed data breaches analyzed by the 2014 Verizon Data Breach Investigations Report, researchers added analysis of more than 63,000 security incidents to reveal the most common attacks. Verizon uncovered actions by cybercriminals, their techniques and the data they are targeting to identify distinct classification patterns. These 10 most common security incidents describe nine distinct patterns that reflect 92 percent of the more than 100,000 security incidents collected over a 10-year period, Verizon said.

The top threat: Web Application Attacks:

Web applications were associated with 3,937 security incidents and 490 confirmed data breaches in 2013. Many of the attacks analyzed by Verizon were targeting popular blogging platforms or content management systems from Joomla, WordPress and Drupal. The company said the attacks appeared to be driven by hacktivists, whose intent is to hack a server and use its power to carry out distributed denial-of-service attacks. Financially motivated cybercriminals also targeted Web applications to infect a website and use it as a platform for drive-by attacks.

Verizon's Recommendations:

Businesses need to ensure content management systems and their components are patched and use strong passwords, Verizon said. They also should consider two-factor authentication and use code-scanning software to find and fix Web application vulnerabilities. Businesses also should enforce lockout policies to guard against brute-force attacks.

The above is an excerpt from Robert Westervelt's apt summary of Verizon's annual report »

"Malware factored in over two-thirds of the 2011 caseload and 95% of all stolen data." So concludes Verizon's 2012 Data Breach Investigation Report.

Keyloggers, form-grabbers, and spyware—malware that capture data from user activity—top the list of "Top 10 Threat Action Types by number of breaches and records" (p.25).

Two other findings:

1. Companies, big and small, saw a fair amount of malicious code designed to capture user inputs, commonly called keyloggers—they were present in almost half of all breaches (48%). This most likely contributed to the use of stolen credentials in roughly one out of three incidents (p.26).
2. Much as it has in the past, the most common malware infection vector continues to be installation or injection by a remote attacker. This covers scenarios in which an attacker breaches a system via remote access and then deploys malware or injects code via web application vulnerabilities (p.27).

For more on major threats and ways to combat them, read the Report »

Symantec: "2011 State of Security Report: 3,300 Companies Sound Off" By CJ Desai, 8/31/2011

The trend: A survey of 3,300 companies in 36 countries finds that while businesses face a variety of risks, the top three concerns are related to data and network security.

Among the survey's findings, ninety-two percent of companies saw losses from cyberattacks and the top three reported losses were:

1. downtime,
2. theft of employee’s identity information, and
3. theft of intellectual property.

These losses translated to monetary costs 84 percent of the time. The top costs were productivity; revenue; lost organization, customer, or employee data; and brand reputation.

One of Symantec's recommendations:

Businesses need to protect information proactively by taking an information-centric approach to protect both information and interactions. Taking a content-aware approach to protecting information is key in identifying and classifying confidential, sensitive information, knowing where it resides, who has access to it, and how it is coming in or leaving your organization. Proactively encrypting endpoints will also help organizations minimize the consequences associated with lost devices.  Read the full report  »