Winning The Cybercrime Battle

Cybercrime has evolved; what used to be the domain of individual actors who had to do all of their own heavy lifting, has now developed into its own malignant and dynamic ecosystem. This is keeping the security industry on its toes.

On October 8, 2018 Google had to shut down the consumer version of its online social network after fixing a bug exposing private data in as many as 500,000 accounts. The US internet giant had to do away with the Google+ social network for consumers, which failed to gain meaningful traction after being launched in 2011 as a challenge to Facebook.

In March 2018, a security audit revealed a software bug that gave third-party apps access to Google+ private profile data that people meant to share only with friends. The company was unable to confirm which accounts were affected by the bug, but an analysis indicated it could have been as many as 500,000 Google+ accounts. It found no evidence that any developer was aware of this bug, or abusing the API (application programming interface software), or that any profile data was misused.”

Earlier this year, Facebook acknowledged that personal data of 29 million users had been hijacked by Cambridge Analytica, a political firm working for Donald Trump in 2016. The hackers accessed the names, phone numbers, and email addresses of 15 million users. For another 14 million people, the attack was potentially more damaging.

Rise in blended cyber attacks

Cybersecurity threats seldom occur in isolation – blended attacks can leverage DDoS threats, botnets, malware, and IPv6 networks to strike systems from various points, concludes a recently released report, The Changing Face of Cyber Attacks by Neustar, Inc. It brings to the fore the ease with which cyber criminals can now leverage existing botnets – such as Mirai, Sartori, and WireX, to launch cyber-attacks on any entity, simply by renting the service online for any purpose the buyer desires.

Australia, China, India, Japan, South Korea, and the Southeast Asian regions have recorded a growing number of botnet breaches in 2018. Japan, Hong Kong, India, and China are amongst the top 10 countries with highest number of potentially vulnerable memcached servers.

In 2018, seven in 10 breaches detected can be attributed to perpetrators outside the organization, and 50 percent were orchestrated by organized criminal groups, while 28 percent of the breaches were executed by members within the organization, says the report.

Data breaches

In the first half of 2018, 945 data breaches led to 4.5 billion data records being compromised worldwide. Compared to the same period in 2017, the number of lost, stolen, or compromised records increased by a staggering 133 percent, though the total number of breaches slightly decreased over the same period, signaling an increase in the severity of each incident.

During the first six months of 2018, more than 25 million records were compromised or exposed every day, or 291 records every second, including medical, credit card, and/or financial data or personally identifiable information. This is particularly of concern, since only 1 percent of the stolen, lost, or compromised data records were protected by encryption to render the information useless, a percent-and-a-half drop compared to the first six months of 2017.

A total of six social media breaches, including the Cambridge Analytica – Facebook incident, accounted for over 56 percent of total records compromised. Of the 945 data breaches, 189 (20 percent of all breaches) had an unknown or unaccounted number of compromised data records. This was revealed by the Breach Level Index, a global database that tracks data breaches.

Malicious outsiders caused the largest percentage of data breaches (56 percent), a slight decrease of almost 7 percent over the second half of 2017 and accounted for over 80 percent of all stolen, compromised, or lost records. Accidental loss accounted for over 879 million (9 percent) of the records lost this half, the second most popular cause of data breaches representing over one-third of incidents. The number of records and incidents involved in malicious insider attacks fell by 50 percent this half compared to the same time period in 2017.

Identity theft continues to be the leading type of data breach. Financial access incidents show a disturbing trend in the escalation of severity. Though overall incident numbers are on the decline H1 2017 versus H1 2018 (171 for H1 2017 and 123 for H1 2018), the number of records breached increased H1 2017 versus H1 2018 (2.7 million and 359 million), respectively.

Most sectors saw an increase in the number of incidents compared to the previous half – the exceptions were government, professional services, retail, and technology, though both government and retail saw an increase in the number of records breached through fewer events. Healthcare continues to lead in the number of incidents (27 percent). Social media ranks top for number of records breached (56 percent) due to the high-profile customer data compromises at Facebook and Twitter, involving 2.2 billion and 336 million respectively.

IoT devices

The market for IoT devices, smart gadgets, and their role in everyday life, is growing exponentially. But cybercriminals are seeing the financial opportunities too, and are multiplying and differentiating their attacks as a result. The danger for consumers, who love their IoT gadgets, is that threats can strike unexpectedly, turning seemingly harmless devices into powerful machines for illegal activity. This can include malicious cryptocurrency mining, DDoS attacks, or the discreet inclusion of devices in botnet activities.

In the first half of 2018, IoT devices were attacked with more than 120,000 modifications of malware, according to the Kaspersky Lab IoT report. That is more than triple the amount of IoT malware seen in the whole of 2017.

It is striking that during the first half of 2018, the number of malware modifications aimed at IoT devices registered by researchers was more than three times higher than the number registered in the whole of 2017. Statistics show that the most popular method of IoT malware propagation is still the brute forcing of passwords – repetitive attempts at various password combinations. Brute forcing was used in 93 percent of detected attacks. In most of the remaining cases, access to an IoT device was gained using well-known exploits.

The devices most often attacking Kaspersky Lab honeypots, for instance, were routers (by a large margin). Sixty percent of the registered attempts to attack its virtual devices were coming from them. The remaining share of compromised IoT gadgets included a variety of different technologies, such as DVR-devices and printers. The honeypots even registered an attack coming from 33 washing machines.

The data center security market

The data center is considered to be a key resource for enterprises and thus needs dedicated security initiatives. Emergence of data center security has helped in safeguarding critical information as well as applications across virtualized environments with optimum protection. Emergence of data center security has helped in safeguarding critical information as well as applications across virtualized environments with optimum protection. Whether a business owner is employing a hybrid or cloud environment, data center security solutions offered by key players ensure high server security.

Strategies such as contact upgradation and joint ventures have helped the companies maintain a competitive edge in the market. Enterprises are observed making huge investments in research and developments to improve their brand image.

The global data center security market has been projected to reach USD 15 billion. The market is anticipated to showcase a staggering growth rate of 13 percent over 2017–2023, owing to the growing emergence of cloud-based technologies. It focuses to make business data less accessible to hackers who are seeking for unauthorized access to data. Data center security finds its application in various industry verticals such as healthcare, retail, BFSI, manufacturing, IT, and telecommunications.

Data center security aims to make the repositories of business data less accessible to hackers or anyone who is seeking unauthorized access for the same. The data center security solutions are also expected to be flexible, effective, and easy to manage. Technology giants such as Hewlett Packard, International Business Machines Corporation, Fortinet Inc., Honeywell International Inc., McAfee, Inc., Dell Inc., Cisco Systems, Inc., and Intel Corporation are some of the major players in the data center security market.

The security industry has a long way to go. IT managers are increasingly becoming aware of the need for innovative responses on their part, to counter a threat industry, which is innovating both technical and business models at a rapid pace.

“With organizations across Asia-Pacific heading toward digital transformation in full force, cybersecurity concerns can no longer be just an afterthought. The fact is that perpetrators are now able to launch complex cyber-attacks with minimal specialized expertise, as botnets can be rented and tools downloaded. As businesses go digital, leaders will have to prepare for blended, multi-vector, attacks and consider a holistic and comprehensive defense. The recent SingHealth breach impacting over 1.5 million Singaporeans is a grave reminder of the serious financial and reputational damage that all businesses face without concerted protection.”

Robin Schmitt
General Manager, APAC,
NeuStar, Inc.