The Cisco 2015 Midyear Security Report, which analyses threat intelligence and cybersecurity trends, reveals the critical need for organisations to reduce time to detection (TTD) in order to remediate against sophisticated attacks by highly motivated threat actors.
This coincides with the decision made by the Department of Justice and Constitutional Development to release their draft Cybercrimes and Cybersecurity Bill for public comment. 2015 has seen a spate of cyber-attacks as threat actors’ ability to innovate rapidly and enhance their capacity to compromise systems and evade detection evolves. The legislative undertaking is therefore indicative of South Africa’s mental shift towards greater cybercrime awareness.
The report covers two main areas:
i Threat Intelligence
This section gives an overview of the latest threat research from Cisco and discusses:
• Criminals’ increasing use of macros involving Microsoft Office.
• New tactics from malware authors to evade detection.
• Risk of malware encounters for specific industry verticals.
• Time to detection of threats.
• Updates on spam, threat alerts, Java exploits, and malvertising.
ii Analysis and Observations
This section focuses on security industry consolidation and the emerging concept of integrated threat defence. Other topics in focus include the importance of building trust and security into products and the value of engaging security services organisations in a market where skilled security talent is scarce. The report discusses how a cohesive cyber-governance framework can be a step toward sustaining business innovation and economic growth on the global stage.
Key highlights
Key findings from the study include the following:
• Exploits of Adobe Flash vulnerabilities are increasing. They are regularly integrated into widely used exploit kits such as Angler and Nuclear. Angler continues to lead the exploit kit market in terms of overall sophistication and effectiveness. The Angler Exploit Kit represents the types of common threats that will challenge organisations as the digital economy and the Internet of Everything (IoE) create new attack vectors and monetisation opportunities for adversaries.
• Operators of crime ware, like ransomware, are hiring and funding professional development teams to help them make sure their tactics remain profitable.
• Criminals are turning to the anonymous web network Tor and the Invisible Internet Project (I²P) to relay command-and-control communications while evading detection.
• Adversaries are once again using Microsoft Office macros to deliver malware. It’s an old tactic that fell out of favour, but it’s being taken up again as malicious actors seek new ways to thwart security protections.
• Some exploit kit authors are incorporating text from Jane Austen’s classic novel Sense and Sensibility into web landing pages that host their exploit kits. Antivirus and other security solutions are more likely to categorise these pages as legitimate after 'reading' such text.
• Malware authors are increasing their use of techniques such as sandbox detection to conceal their presence on networks.
• Spam volume is increasing in the United States, China, and the Russian Federation, but remained relatively stable in other regions in the first five months of 2015.
• The security industry is paying more attention to mitigating vulnerabilities in open-source solutions.
• Continuing a trend covered in the Cisco 2015 Annual Security Report, exploits involving Java have been on the decline in the first half of 2015.
A call to action
The innovation race between adversaries and security vendors is accelerating, placing end users and organisations at increasing risk. Vendors must be vigilant in developing integrated security solutions that help organisations be proactive and align the right people, processes, and technology.
• Integrated threat defence – Organisations face significant challenges with point product solutions and need to consider an integrated threat defence architecture that embeds security everywhere, and will enforce at any control point.
• Services fill the gap – As the security industry addresses increased fragmentation, a dynamic threat landscape, and how to cope with a rising shortfall of skilled talent, businesses must invest in effective, sustainable and trusted security solutions and professional services.
• Global cyber governance framework – Global cyber governance is not prepared to handle the emerging threat landscape or geopolitical challenges. The question of boundaries – how governments collect data about citizens and businesses and share among jurisdictions – is a significant hurdle to achieving cohesive cyber governance as worldwide cooperation is limited. A collaborative, multi-stakeholder cyber governance framework is required to sustain business innovation and economic growth on a global stage.
• Trustworthy vendors – Organisations should demand that their technology vendors are transparent about and able to demonstrate the security they build into their products in order to be considered trustworthy. These organisations must carry this understanding across all aspects of product development starting with the supply chain and through the deployed life of their products. They must ask vendors to contractually back up their claims and demand better security.
Download the report at http://www.cisco.com/web/offers/lp/2015-midyear-security-report/index.html?keycode=000854836www.cisco.com/go/msr2015
© Technews Publishing (Pty) Ltd. | All Rights Reserved.
printer friendly version