Widening gulf between perception and reality

April 2015 Information Security

The Cisco 2015 Annual Security Report, which examines both threat intelligence and cybersecurity trends, reveals that South African organisations must adopt an ‘all hands on deck’ approach to defend against cyber attacks. Attackers have become more proficient at taking advantage of gaps in security to evade detection and conceal malicious activity as evidenced by the recent attacks against the Gautrain and Eskom.

Greg Griessel, consulting systems engineer, security solutions, Cisco, South Africa.
Greg Griessel, consulting systems engineer, security solutions, Cisco, South Africa.

Defenders, namely security teams, must constantly improve their approach to protect their organisations from these increasingly sophisticated cyber attack campaigns. These issues are further complicated by the geo­political motivations of the attackers, conflicting cross-border data localisations and sovereignty requirements.

Cisco’s Security Manifesto

The report findings conclude that it’s time for South African corporate boards to take a role in setting security priorities and expectations. Cisco’s Security Manifesto, a formal set of principles, provides foundation to achieving security and can help corporate boards, secur­ity teams and the users in any organisation in the country, to better understand and respond to the cybersecurity challenges.

The manifesto’s principals are:

1. Security must support the business.

2. Security must work with existing architecture – and be usable.

3. Security must be transparent and informative.

4. Security must enable visibility and appropriate action.

5. Security must be viewed as a ‘people problem.’

Greg Griessel, consulting systems engineer, security solutions, Cisco, South Africa, says, “Security is now the responsibility of everyone within South African organisations, from the board room to individual users. Security leaders and practitioners need the support of the entire business to combat malicious actors who are increasing in their proficiencies to exploit weakness and hide their attacks in plain sight.

“To protect organisations against attacks across the attack continuum, CISOs need to ensure that their teams have the right tools and visibility to create a strategic security posture, as well as educate users to aid in their own safety and the safety of the business. Attackers have become more proficient in taking advantage of security gaps and are targeting unsuspecting South African users. At any given time, we should expect one percent of high-urgency vulnerabilities to be actively exploited while 56 percent of all OpenSSL ­versions are still vulnerable to Heartbleed.”

The attackers

Online criminals are expanding their tactics and morphing their messages to carry out cyber-attack campaigns and make it harder to detect them. The top three trends that Cisco’s threat intelligence uncovered are:

• Snowshoe spam: Emerging as a preferred strike method, attackers are sending low volumes of spam from a large set of IP addresses to avoid detection.

• Web exploits hiding in plain site: Widely used exploit kits are getting dismantled by security companies in short order. As a result, online criminals are using other less common kits to successfully carry out their tactics – a sustainable business model as it does not attract too much attention.

• Malicious combinations: Flash and JavaScript have historically been insecure on their own, but with advances in security, attackers are combining the weaker of the two parts. Flash malware can now interact with JavaScript to hide malicious activity by sharing an exploit between two different files: one Flash, one JavaScript. This type of blended attack is very hard to detect.

The users

Users are caught in the middle – not only are they the targets, but end-users are unknowingly aiding cyber attacks. Throughout 2014, Cisco threat intelligence research revealed that attackers have increasingly shifted their focus from servers and operating systems. This is because more users now are downloading from compromised sites leading to a 280% increase in Silverlight attacks along with a 250% increase in spam and malvertising exploits.

The defenders

Results from Cisco’s Security Benchmark Study, which surveyed Chief Information Security Officers (CISOs) and security operations executives at 1700 companies globally reveals a widening gap in defender intent and actions. Specifically, the study indicates that 75% of CISOs see their security tools as very or extremely effective. However, less than 50% of respondents use standard tools such as patching and configuration to help prevent security breaches and ensure that they are running the latest versions.

Heartbleed was landmark vulnerability last year, yet 56% of all OpenSSL versions are over 4.5 years old. That is a strong indicator that security teams are not patching.

While many defenders believe their security processes are optimised – and their security tools are effective – in truth, their security readiness likely needs improvement.

For a complete copy of Cisco’s Annual Security Research report go to www.cisco.com/go/asr2015





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...
Cybersecurity in South Africa
Information Security
According to the Allianz Risk Barometer 2025, cyber incidents, including ransomware attacks, data breaches and IT outages, are now the top global business risk, marking their fourth year at the top.

Read more...
Are AI agents a game-changer?
Information Security
While AI-powered chatbots have been around for a while, AI agents go beyond simple assistants, functioning as self-learning digital operatives that plan, execute, and adapt in real time. These advancements do not just enhance cybercriminal tactics, they may fundamentally change the battlefield.

Read more...
Disaster recovery vs cyber recovery
Information Security
Disaster recovery centres on restoring IT operations following events like natural disasters, hardware failures or accidents, while cyber recovery is specifically tailored to address intentional cyberthreats such as ransomware and data breaches.

Read more...
Back-up securely and restore in seconds
Betatrac Telematic Solutions Editor's Choice Information Security Infrastructure
Betatrac has a solution that enables companies to back-up up to 8 TB of data onto a device and restore it in 30 seconds in an emergency, called Rapid Access Data Recovery (RADR).

Read more...
The rise of AI-powered cybercrime and defence
Information Security News & Events AI & Data Analytics
Check Point Software Technologies launched its inaugural AI Security Report, offering an in-depth exploration of how cybercriminals are weaponising artificial intelligence (AI), alongside strategic insights defenders need to stay ahead.

Read more...
The deepfake crisis is here and now
Information Security Training & Education
Deepfakes are a growing cybersecurity threat that blur the line between reality and fiction. These AI-generated synthetic media have evolved from technological curiosities to sophisticated weapons of digital deception, costing companies upwards of $600 000 each.

Read more...
What does Agentic AI mean for cybersecurity?
Information Security AI & Data Analytics
AI agents will change how we work by scheduling meetings on our behalf and even managing supply chain items. However, without adequate protection, they become soft targets for criminals.

Read more...
Phishing attacks through SVG image files
Kaspersky News & Events Information Security
Kaspersky has detected a new trend: attackers are distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files, a format commonly used for storing images.

Read more...