MALWARE IS SO 2017: FIVE SECURITY TRENDS TO WATCH OUT FOR
“Security and risk management leaders have operated in the shadows for a long time. Now it’s their opportunity to shine,” said Peter Firstbrook, research vice president at Gartner. “If they exploit emerging trends and build a strong security program, they can keep their organization safe and significantly elevate their standing.”
Remember when several massive ransomware attacks went global and hit many big businesses? Outbreaks such as Petya and WannaCry really put the malware threat on the IT agenda and made cybersecurity a priority for everyone. But it doesn’t stop with malware, there are many more security threats out there. The attackers’ arsenal is expanding and becoming more complex. Fredrik Svantes, Senior Information Security Manager at Basefarm, discussed with us the latest developments that keep the cybersecurity community busy.
1. Use of standard tools by attackers
Many companies have become much more aware of the need to be more secure. Greater cybersecurity efforts have made it harder for attackers to remain undetected while they are within their target’s network. In its recent annual report, the Dutch national intelligence agency AIVD reports an increase in the use of standard tools for attacks, some from nations dabbling in digital espionage. Fredrik Svantes, sees this happening more and more: “Attackers don’t want to get caught while stealing valuable data. High-profile targets deploy many security systems, malware detection systems for example. If attackers use specific “hacker tools” in their reconnaissance phase, this will raise a red flag. So, they opt for standard Windows tools, like Microsoft Power Shell, to look around in the network.”
2. Big data becomes a security system
How to keep out attackers who apply standard tools? Basically, this comes down to setting up a baseline for how employees use their systems. This is where big data analytics comes into the picture as it can help detect anomalies. “For instance, technicians will have certain work routines, while people in the finance department have a different workflow. When suddenly someone in the finance department opens Power Shell, this is not a standard behavior. This will trigger warning signals even though it just happens to be a standard Windows application.” Especially users with high security risks, like government and companies with significant volumes of IP or critical data to protect, rely on big data for security. Svantes: “Facebook does so for sure.”
3. Security professionals are hard to find
Organizations looking to hire security professionals find themselves competing in a fierce market. “If you need security personnel in about a year, you’d better start recruiting them now,” says Svantes. “You can’t start recruiting just three months before an important project.” Although the situation might be improving, with several top European universities introducing security education programs, right now the lack of experts is a huge problem. For most companies, the best immediate bet is to look for external partners who can help to secure their IT. “Not every company needs a team of security professionals, but what everyone does need is people who are security aware. For example, developers should have security in the back of their minds while working on their projects.”
4. Your servers turn into secret bitcoin miners
Regardless of the market you operate in, a trend that is emerging is criminals utilizing compromised servers for crypto mining which requires high amounts of computing power. “To have a single server mining for cryptocurrency is not very efficient, but it adds up when you have thousands of compromised servers working for you. Because crypto mining networks use substantial resources, the increase of resource usage can often set off alarm bells if proper detection measures are in place.” How can attackers be kept out? Most importantly, make sure your systems are up to date. Don’t leave things unpatched or run old versions of software. And of course: don’t click on everything you see. Attackers still see e-mail scams as an attractive “way in”.
5. A shift from prevention to detection
“It’s one thing to try to protect your company, but there is no way to be 100% protected,” Svantes states. “The past couple of years have witnessed a strong focus on preventing attacks from happening. But now, many companies are waking up to the fact that they can only prevent so much. What they can do however, is try to detect intrusions as soon as they happen.” In a world of changing threats and compute-everywhere environments, the old security paradigm of just building bigger walls will be replaced by a continuum from block to allow. Machine Learning is becoming the key technology for predicting, detecting and preventing known and unknown threats. According to Gartner, deploying threat detection and response tools is a top priority for Chief Information Security Officers (CISOs). These investments can make a big difference. A recent report published by the US Ponemon Institute calculates that when an intrusion is found in less than 100 days, the average cost is $2.8 million. When detection takes longer than 100 days, the expense jumps to $3.8 million.
Want more information?
Read more about our emphasis on security here, our security standards here and our security services here!
The State of Breach Protection 2020
This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT). “What are the key considerations security decision makers should take into account when designing their 2020 breach protection?” 1,536 cybersecurity professionals has been asked that question and many other security related questions in Cynet’s […]
New year, new vulnerabilities
This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT). The year 2020 started of by throwing out a bunch of new vulnerabilities that needed fixing. First it was the Citrix vulnerability in Application Delivery Controller and Gateway products, formerly known as netscaler. The […]
Basefarm security news
This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT). Florida has been become a target for two serious ransomware attacks. The city of Pensacola reported a cyber incident that reportedly started Saturday morning. The city disconnected much of the city’s network, and affected […]
Security Software & Tools Tips – December 2019
In this monthly post, we try to make you aware of five different security-related products. This is a repost from my personal website Ulyaoth This month we have chosen for the following: * Azure Arc * CloudGuard Dome9 * Flan Scan * Lynis * Wapiti Azure Arc Information from the Azure Arc website: Azure Arc […]
Threat Hunting or Efficiency: Pick Your EDR Path?
This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT). Cybersecurity teams face a lot of conflicting objectives—both within their teams and from upper management. But a May 2019 commissioned study conducted by Forrester Consulting on behalf of McAfee really puts a fine point […]
Data leaks and breaches
This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT). Today I want to take a look at data leaks and breaches as the last week has had quite a few of those. Unicef Norway had a database exposed to the internet (Paywall) without […]
Visa Warns of New JavaScript Skimmer ‘Pipka’
This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT). A new JavaScript skimmer targets data entered into the payment forms of ecommerce merchant websites, Visa Payment Fraud Disruption (PFD) warns. Visa notes in a security alert (PDF). “In September 2019, Visa Payment Fraud […]
Insider threats
This blog post is a summary of this week’s Information Security News put together by our Security Incident Response Team (SIRT). This week we have seen multiple cases of one of the harder issues in security, the insider threat. Two former employees of twitter have been charged with spying on Twitter users for Saudi Arabia, […]
