Partner Perspectives  Connecting marketers to our tech communities.
7/30/2015
10:55 AM
Raja Patel
Raja Patel
Partner Perspectives
50%
50%

Study Reveals the Most Common Attack Methods of Data Thieves

Learning more about your attackers helps to improve your security profile and reduce the possibility of a breach.

Sophisticated criminals using advanced techniques are behind most of the recent security breaches, targeting small network openings and user weaknesses left vulnerable by even the latest shiny new technology. The painful reality is that security operations are struggling with the ever increasing number of threats and attack vectors, while trying to navigate the confusing landscape of security offerings. To add insult to injury, as operations is endeavoring to get its collection of security systems working together and defending every possible security gap, data thieves only have to find a single exploitable opening.

Our research report, A Thief’s Perspective, looks at the five attack methods that made up the majority of the almost 55 million attacks in Q1 2015. From browser blunders to denial of service, learning more about your attackers helps to improve your security profile and reduce the possibility of a breach. A related report surveyed security professionals on the security readiness of critical infrastructure; these professionals reported a high degree of confidence in their cyber defenses, even in the face of increasing threats. They also felt that increased cooperation between organizations, security vendors, and government agencies was critical to a successful cyber defense.

Interrupted Internet

Interrupting or denying access to Internet services remains the number one attack method, representing over 40% of all attacks. That is partially because this abuse of network resources is the easiest method, requiring only a few dollars in Bitcoin transactions to rent time on a distributed denial of service (DDoS) tool and flood a website with malicious traffic. Sometimes that is the whole attack, sometimes it is a deception tool to distract your security team while the real attack slips in unnoticed. Defenses against DDoS attacks have greatly improved, but they still rely on a solid understanding of normal volumes and patterns in order to quickly identify the beginnings of a DDoS flood, deep-packet and SSL inspection to understand the nature of the abusive packets, and powerful filtering to keep them away from your Internet resources.

When they want to actually get inside, thieves are still focused on users as the weakest point in your defenses. Whether it is from phishing emails, social engineering, or compromised websites, we have seen an 87% growth in suspect URLs in the last year, and browser-based attacks now make up over 35% of all attacks. Thieves are often focused on a specific department or a few key individuals, and will persistently target them until they get that one click they need. Not only is the number of malicious URLs growing rapidly, but thieves are also hiding their malware in feature-rich content such as Adobe Flash and JavaScript, making it harder to catch with static filters. Users need the added protection of intelligent content filtering that can emulate the browser functions to determine the true intent of any inbound scripting or multimedia file and dynamically adapt to user and attacker behavior.

Stealth Attacks

While the vast majority of attacks are knocking on the front door or trying to trick users with increasingly sophisticated Web lures, others are trying to sneak in by stealth, evade your defenses, or slip through in an encrypted stream. One of the big advantages attackers have is that they can analyze every aspect of your defenses, test various products, and try repeated approaches to figure out what might get through. They break malware up into small pieces for later reassembly, try to stay dormant during sandbox inspections, and randomize their callback addresses to get back-out. Finding these devious attacks requires collaboration from all of your defenses to correlate anomalous events and identify the malicious activities from the noise.

We believe that your information and systems can be protected, attacks can be detected, and breaches quickly corrected if we all act in concert. Information silos and shiny new toys will not reduce the number of threat vectors, but real-time information sharing and coordination between security defenses will significantly increase detection rates and reduce the time to contain and correct the situation if any manage to slip through. We need to change the way we think about security if we want a better prognosis about the realities of today’s threat landscape.

Raja Patel is vice president in the Intel Security Group and general manager of the Network Security business unit at Intel Corporation. He is responsible for defining and executing the strategic direction for Intel Security's Network Security business, which includes network ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Ulf Mattsson
50%
50%
Ulf Mattsson,
User Rank: Moderator
7/31/2015 | 11:46:48 AM
We need to change the way we think about security
I agree that "data thieves only have to find a single exploitable opening," and "We need to change the way we think about security if we want a better prognosis about the realities of today's threat landscape."

Ponemon Institute published an interesting survey related to the recent spate of high-profile cyber attacks. According to the survey database security was recommended by 49% of respondents, but the study found that organizations continue to allocate the bulk of their budget (40%) to network security and only 19% to database security.

Ponemon concluded that "This is often because organizations have traditionally spent money on network security and so it is earmarked in the budget and requires no further justification."

We are seeing a number of common issues across recent data breaches, stealing our most sensitive data, and I think it is time to re-think our security approach and be more data-centric.   

Ulf Mattsson, CTO Protegrity
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
New Mirai Version Targets Business IoT Devices
Dark Reading Staff 3/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Reading Schneier's Friday Squid Blog again?
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.