Reasons why organizations fall prey to pervasive 'Cybercrime-as-a-Service' attacks

BANGALORE, INDIA: Fortinet's recent Global Threat Landscape Report reveals that while more high profile attacks have dominated the headlines, the reality is that the majority of threats faced by most organizations are opportunistic in nature fueled by a pervasive Crime-as-a-Service infrastructure.

Three important research highlights are :

Attack Tools Never Forget and Are Always Ready for Service, Anywhere and Anytime

The Internet is not bound by geographic distances and boundaries, so most threat trends appear more global than regional. And modern tools and Cybercrime-as-a-Service infrastructures enable adversaries to operate on a global scale at light speed.

Ransomware: Just under 10% of organizations detected activity associated with ransomware. On any given day, an average of 1.2% dealt with ransomware botnets running somewhere in their environment. The peak days of activity fell on weekends, with the hope of slipping traffic past weekend security operations staff. As the average traffic volume of various ransomware botnets increased, the average number of firms impacted by them rose as well.

Exploit Trends: 80% of organizations reported high or critical-severity exploits against their systems. The majority of these targeted vulnerabilities were released in the last five years, but no shortage of attempts was made against premillennial Common Vulnerabilities and Exposures (CVE). Exploit distribution was pretty consistent across geographical regions, likely because a huge proportion of exploit activity is fully automated via tools that methodically scan wide swaths of the Internet probing for opportunistic openings.

Visibility of Distributed and Elastic Infrastructure is Diminishing

Visibility and control over today’s infrastructures are diminishing as the number of potential attack vectors across the expanded network landscape continues to grow. The rush to adopt private and public cloud solutions, the growth of IoT, the variety and volume of smart devices connecting to the network, and out-of-band threat vectors like shadow IT have stretched security professionals past their limits.

Encrypted Traffic: The median ratio of HTTPS to HTTP traffic hit a high mark of nearly 55%. While helpful for maintaining privacy, this trend presents challenges to threat monitoring and detection. Many defensive tools have poor visibility into encrypted communications. Organizations—especially those with higher HTTPS ratios—could face threats lurking within encrypted communications.

Applications: The median number of cloud applications used per organization was 62, which is roughly a third of all applications detected, with IaaS applications hitting a new high point. For many of these organizations, the challenge is that data visibility can drop significantly once it moves into the cloud. In addition, data stored in these applications and services continues to grow, instead of shrink therefore, this is a problematic trend.

Industry Sectors: Cluster analysis by vertical industry shows that the attack surface across most industries was the same with a few exceptions such as the Education and Telco sectors. This means that adversaries can easily exploit similar attack surfaces across industries more easily, especially with automated tools.

Hyperconvergence and IoT Are Accelerating the Spread of Malware

As networks and users increasingly share information and resources, attacks are spreading rapidly across distributed geographic areas and a wide variety of industries. Protecting against mobile malware is particularly challenging because devices are not shielded on the internal network, are frequently joining public networks, and often are not under corporate ownership or control.

Mobile Malware: The prevalence of mobile malware remained steady from Q4 2016 to Q1 2017, with about 20% of organizations detecting it. More Android malware families made the top 10 list by volume or prevalence this quarter. The overall ratio among all types of malware was 8.7% for Q1 comparing to Q4’s 1.7%.

Phil Quade, chief information security officer, Fortinet said, “In the past year, highly-publicized cybersecurity incidents have raised public awareness of how our TVs & phones can be manipulated to deny others’ Internet availability, and have shown, that demanding ransom is being used to disrupt vital patient care services. Yet, awareness alone isn’t enough. Unfortunately, as organizations increasingly adopt convenience and cost-savings IT techniques, such as cloud services, or add a variety of smart devices to their network, visibility and control of their security is at risk. Meanwhile, attackers are buying or re-using tools of their own. Cybersecurity strategies need to increasingly adopt trustworthy network segmentation and high degrees of automation to prevent and detect adversaries’ efforts to target the newly-exposed flanks of our businesses and governments.”