Sophisticated criminals using advanced techniques are behind most of the recent security breaches, targeting small network openings and user weaknesses left vulnerable by even the latest shiny new technology. The painful reality is that security operations are struggling with the ever increasing number of threats and attack vectors, while trying to navigate the confusing landscape of security offerings. To add insult to injury, as operations is endeavoring to get its collection of security systems working together and defending every possible security gap, data thieves only have to find a single exploitable opening.
Our research report, A Thief’s Perspective, looks at the five attack methods that made up the majority of the almost 55 million attacks in Q1 2015. From browser blunders to denial of service, learning more about your attackers helps to improve your security profile and reduce the possibility of a breach. A related report surveyed security professionals on the security readiness of critical infrastructure; these professionals reported a high degree of confidence in their cyber defenses, even in the face of increasing threats. They also felt that increased cooperation between organizations, security vendors, and government agencies was critical to a successful cyber defense.
Interrupting or denying access to Internet services remains the number one attack method, representing over 40% of all attacks. That is partially because this abuse of network resources is the easiest method, requiring only a few dollars in Bitcoin transactions to rent time on a distributed denial of service (DDoS) tool and flood a website with malicious traffic. Sometimes that is the whole attack, sometimes it is a deception tool to distract your security team while the real attack slips in unnoticed. Defenses against DDoS attacks have greatly improved, but they still rely on a solid understanding of normal volumes and patterns in order to quickly identify the beginnings of a DDoS flood, deep-packet and SSL inspection to understand the nature of the abusive packets, and powerful filtering to keep them away from your Internet resources.
While the vast majority of attacks are knocking on the front door or trying to trick users with increasingly sophisticated Web lures, others are trying to sneak in by stealth, evade your defenses, or slip through in an encrypted stream. One of the big advantages attackers have is that they can analyze every aspect of your defenses, test various products, and try repeated approaches to figure out what might get through. They break malware up into small pieces for later reassembly, try to stay dormant during sandbox inspections, and randomize their callback addresses to get back-out. Finding these devious attacks requires collaboration from all of your defenses to correlate anomalous events and identify the malicious activities from the noise.
We believe that your information and systems can be protected, attacks can be detected, and breaches quickly corrected if we all act in concert. Information silos and shiny new toys will not reduce the number of threat vectors, but real-time information sharing and coordination between security defenses will significantly increase detection rates and reduce the time to contain and correct the situation if any manage to slip through. We need to change the way we think about security if we want a better prognosis about the realities of today’s threat landscape.