DOCSLIB.ORG

Cisco Midyear Cybersecurity Report 2017

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Cisco Midyear Cybersecurity Report 2017 Cisco Midyear Cybersecurity Report 2017 1 Inhalt Zusammenfassung .........................................................3 Veröffentlichung von Schwachstellen führt Wichtigste Erkenntnisse ................................................5 zu vermehrten Angriffen ...............................................47 Einleitung ........................................................................7 Setzen Sie Ihr Geschäft keinem Risiko durch DevOps-Technologien aus ............................................50 Verhalten von Angreifern ...............................................9 Organisationen führen Patches für bekannte Exploit-Kits: viele inaktiv, aber nicht alle .........................9 Schwachstellen von Memchached-Servern Der Einfluss des Verhaltens der Verteidiger nicht schnell genug durch .............................................54 auf die Nutzung anderer Angriffsstrategien ................. 11 Hacker wenden sich der Cloud zu, um attraktive Web-Angriffsmethoden entwickeln sich gemeinsam Ziele schneller zu attackieren ........................................56 mit dem Internet ...........................................................12 Nicht verwaltete Infrastrukturen und Endpunkte Weltweite Blockierungsaktivität im Web ........................13 stellen Risiken für Organisationen dar ...........................59 Spyware ist wirklich so schlimm, wie sie klingt .............14 Herausforderungen in puncto Sicherheit und Möglichkeiten für Verteidiger ...............................61 Rückgang der Exploit-Kit-Aktivität wirkt sich wahrscheinlich auf globale Spam-Trends aus ...............18 Security Capabilities Benchmark Study: Fokus auf verschiedenen Branchen ..............................................61 Schädliche E-Mails: Ein genauerer Blick auf die Dateityp-Strategien von Malware-Programmierern .......19 Unternehmensgröße hat Einfluss auf den Sicherheitsansatz ...................................................62 Ist Ransomware ein Thema, das Ihnen Sorgen bereitet? E-Mail-Angriffe könnten eine noch Wissens- und Talentlücken mit Services schließen .......63 größere Bedrohung darstellen. .....................................22 Outsourcing von Services und Daten zu Malware-Entwicklung: eine Halbjahres-Betrachtung .....23 Bedrohungswarnhinweisen nach Land ..........................64 Threat-Intelligence von Talos: Auf den Spuren IoT-Sicherheitsrisiken: Vorbereitung auf der Angriffe und Schwachstellen ..................................24 das Jetzt und die Zukunft .............................................65 Beschleunigte Bedrohungserkennung: Das Tauziehen Security Capabilities Benchmark Study: Fokus auf zwischen Angreifern und Verteidigern wird knapper .....26 ausgewählte Branchen .................................................66 Trends bei der Weiterentwicklungszeit: Service Provider .......................................................... 66 Nemucod, Ramnit, Kryptik und Fareit ............................28 Öffentlicher Sektor ..................................................... 68 Längere Lebensdauer – und Überschneidung – von Einzelhandel ................................................................ 70 DGA-Domänen .............................................................33 Fertigung ..................................................................... 72 Infrastrukturanalyse schafft weitere Kenntnisse über Angreifertools .......................................................34 Versorgungsunternehmen ........................................... 74 Angriffe auf die Lieferkette: Bereits ein kompromittierter Gesundheitswesen ...................................................... 76 Vektor kann viele Organisationen beeinträchtigen .........36 Transport- und Verkehrswesen ................................... 78 Das Internet of Things (IoT) nimmt gerade erst Fahrt Finanzwesen ............................................................... 80 auf, aber die IoT-Botnets sind bereits zur Stelle ............39 Fazit ...............................................................................83 Erpressung im Cyberspace: Ransom Denial of Service (RDoS) ............................... 41 Cybersicherheit muss einen festen Platz in der Agenda der Geschäftsführung einnehmen ........ 84 Neue Methoden der Hacker ........................................ 42 Informationen zu Cisco ................................................86 Ransomware-Angriffe auf medizinische Geräte ............42 Mitwirkende am Cisco Midyear Schwachstellen ............................................................46 Cybersecurity Report 2017 ...........................................86 Geopolitisches Update: WannaCry-Angriff Cisco Midyear Cybersecurity unterstreicht das Risiko der Ansammlung von Report 2017 Technologiepartner ..................................88 Informationen über ausnutzbare Schwachstellen ..........46 Cisco Midyear Cybersecurity Report 2017 Zusammenfassung Seit fast zehn Jahren erstellt und veröffentlicht Cisco Cybersecurity Reports, um Security Teams und den Unternehmen, die von ihnen unterstützt werden, dabei zu helfen, neue Cyberbedrohungen und Schwachstellen schnell zu erkennen und die Cybersicherheit zu verbessern. Mit diesen Reports möchten wir Unternehmen vor neuen und immer ausgereifteren Bedrohungen warnen und ihnen die Techniken der Angreifer aufzeigen, mit denen sie Benutzer kompromittieren, Informationen stehlen und Unterbrechungen verursachen. In unserem neuesten Report müssen wir eine noch wachsenden Angriffsfläche ihren Nutzen ziehen. Die deutlichere Warnung aussprechen. Die rasant steigende jüngsten Ransomware-Angriffe allein zeigen wie geschickt Geschwindigkeit der Veränderungen und die zunehmende Gegner die Sicherheitslücken und Schwachstellen der Komplexität der Cyberbedrohungslandschaft gehören einzelnen Geräte und Netzwerke für eine größtmögliche zu den größten Herausforderungen und Sorgen unserer Wirkung nutzen. Security-Experten. Die Unternehmen selbst verbessern zwar ihre Fähigkeit zur Aufspürung von Bedrohungen und Mangelnde Transparenz in dynamischen IT-Umgebungen, Verhinderung von Angriffen und unterstützen Benutzer die Risiken durch die „Shadow-IT“, die ständige Flut und andere Organisationen bei einer schnellen Behebung. von Sicherheitswarnungen und die Komplexität der IT- Jedoch zeichnen sich zwei Trends ab, welche die hart Sicherheitsumgebung. Dies sind nur einige Gründe, weshalb erkämpften Erfolge der Unternehmen untergraben, weitere ressourcenschwache Sicherheitsteams damit kämpfen, Fortschritte ausbremsen und ein neues Zeitalter von den Überblick über die heute schwer erfassbaren und Cyberrisiken und -bedrohungen einläuten. zunehmend wirkungsvollen Cyberbedrohungen zu behalten. Die fatalen Folgen von Sicherheitslücken Inhalte des Reports Umsatzgenerierung ist immer noch das oberste Ziel der Der Cisco Midyear Cybersecurity Report 2017 erforscht meisten Angreifer. Einige haben nun die Möglichkeit – die oben genannten dynamischen Trends anhand und anscheinend auch das Verlangen – im Rahmen ihrer folgender Aspekte: Angriffe Systeme zu sperren und Daten zu zerstören. Wie im Abschnitt „Einleitung“ im Cisco Midyear Cybersecurity Taktiken der Gegner Report 2017 auf Seite 7 erläutert, betrachten unsere Wir prüfen ausgewählte Methoden, die von Angreifern Experten diese bedrohliche Aktivität als Vorstufe zu einer genutzt werden, um Benutzern zu schaden und in Systeme neuen und verheerenden Art von Angriff, die sich in naher einzudringen. Für die Verteidiger ist es wichtig, die Zukunft entwickeln könnte: Destruction of Service (DeOS). Veränderungen in den Taktiken der Gegner zu verstehen, sodass sie im Gegenzug ihre Sicherheitspraktiken anpassen Im Laufe des vergangenen Jahres konnten wir beobachten, und Benutzer schulen können. Zu den Themen in diesem dass IoT-Geräte bei DDOS-Angriffen eingesetzt werden. Bericht zählen neue Entwicklungen in der Malware, Botnet-Aktivitäten im IoT deuten darauf hin, dass hier der Trends bei Web-Angriffsmethoden und Spam, die Risiken Grundstein gelegt werden soll für einen weitreichenden von potenziell unerwünschten Anwendungen (PUA) wie Angriff mit hohen Auswirkungen, die potenziell das Spyware, kompromittierte Geschäfts-E-Mails (BEC bzw. gesamte Internet zum Stillstand bringen können. CEO-Betrug), die sich verändernde Hackerwirtschaft und Kompromittierungen von medizinischen Geräten. Unsere Bedrohungsexperten stellen auch Analysen darüber vor, Tempo und Umfang der Technologie wie – und wie schnell – einige Gegner ihre Tools und Unsere Bedrohungsexperten beobachten nun seit Techniken weiterentwickeln. Darüber hinaus stellen sie Jahren, wie Mobility, Cloud-Computing und andere ein Update zu den Bemühungen von Cisco vor, die Zeit bis technologische Neuerungen und Trends zu einer zur Erkennung von Bedrohungen (Time to Detection, TTD) Ausweitung der Sicherheitsmaßnahmen und -bemühungen zu reduzieren. der Unternehmen führen. Wir erkennen heute auch viel besser, wie Cyberkriminelle aus dieser ständig 3 Zusammenfassung Cisco Midyear Cybersecurity Report 2017 Schwachstellen Chancen für Verteidiger In diesem Report erhalten Sie einen Überblick über Der Cisco Midyear Cybersecurity Report 2017 stellt weitere Schwachstellen und andere Sicherheitslücken, die Erkenntnisse aus der neuesten Security Capabilities Organisationen und Benutzer kompromittierbar oder Benchmark Study von Cisco vor. Wir stellen umfangreiche angreifbar machen. Zu den erörterten Themen zählen Analysen der wesentlichen Sicherheitsbedenken in acht schlechte Sicherheitspraktiken, wie unzureichend schnelle
Load more

Recommended publications
  • Iot Threats, Challenges and Secured Integration
    IoT Threats, Challenges and Secured Integration Christian Shink, p. eng., CSSLP System Engineer • Why IoT Devices? • Bot Attacks • 3 Botnets fighting over IoT Firepower • Secure IoT integration Why IoT Devices Internet of Things Internet working of physical devices, vehicles, buildings, … Devices embedded with electronics, software, sensors, actuators Network connectivity Any Path Any Service Any Network Anytime Any Business Any context Anyone Machinery Anybody Building energy Anything Management Any Device Healthcare Retail A Rapidly Growing Number of Connected Devices Copyright © 2017 Radware. All rights reserved. IoT is Highly Susceptible to Cyber Attacks IoT devices run an embedded or stripped-down version of the familiar Linux operating system. 1 Malware can easily be compiled for the target architecture, mostly ARM, MIPS, x86 internet-accessible, lots of (I)IoT and ICS/SCADA are deployed without any form of 2 firewall protection Stripped-down operating system and processing power leaves less room for security 3 features, including auditing, and most compromises go unnoticed by the owners To save engineering time, manufacturers re-use portions of hardware and software in different 4 classes of devices resulting in default passwords and vulnerabilities being shared across device classes and manufacturers Internet Security Trend report 2015 by Nexus guard: IoT is becoming a soft target for cyber-attack Copyright © 2017 Radware. All rights reserved. From the News “D-Link failed to take reasonable steps to secure its routers and IP cameras, potentially compromising sensitive consumer information” “The cameras aren’t designed to receive software updates so the zero-day exploits can’t be patched.” “We believe that this backdoor was introduced by Sony developers on purpose” Sources: 1.
    [Show full text]
  • The Use of the Modern Social Web by Malicious Software
    Malicious software thrives in the richness of the social web ecosystem, which incorporates mobile devices, reliable networks, powerful browsers and sociable users. Modern malware is programmed to take full advantage of these elements, which are especially potent in the context of social media and social networking websites. As the result, we’re seeing malware exhibit the following characteristics: • Using social networking sites to remotely direct malicious tools and attackers' actions • Controlling social media site content to provide attackers with financial rewards • Distributing links on websites with social capabilities to for autonomous malware propagation • Defrauding participants of the social web by using chat bots and other techniques Read this briefing to understand how malicious software makes use of these techniques to thrive on the social web and to offer lucrative benefits to malware authors and operators. Together, we can better understand such emerging threat vectors and devise defenses. Copyright 2011‐2012 Lenny Zeltser 1 Social capabilities of modern websites and applications are changing how people communicate with each other and how businesses interact with customers. The social web incorporates sites that allow people to easily publish content and distribute public, private and semi‐private messages. This includes traditional blogging platforms such as Blogger, micro blogs such as Tumblr, photo sharing sites such as Flickr and social networking sites such as Facebook. We increasingly rely on the social web for both routine and crisis‐related interactions. The attackers are also paying attention to this medium. Copyright 2011‐2012 Lenny Zeltser 2 Authors and operators of malware are paying increasing attention to social media and social networking sites for conducting malicious activities.
    [Show full text]
  • Reporting, and General Mentions Seem to Be in Decline
    CYBER THREAT ANALYSIS Return to Normalcy: False Flags and the Decline of International Hacktivism By Insikt Group® CTA-2019-0821 CYBER THREAT ANALYSIS Groups with the trappings of hacktivism have recently dumped Russian and Iranian state security organization records online, although neither have proclaimed themselves to be hacktivists. In addition, hacktivism has taken a back seat in news reporting, and general mentions seem to be in decline. Insikt Group utilized the Recorded FutureⓇ Platform and reports of historical hacktivism events to analyze the shifting targets and players in the hacktivism space. The target audience of this research includes security practitioners whose enterprises may be targets for hacktivism. Executive Summary Hacktivism often brings to mind a loose collective of individuals globally that band together to achieve a common goal. However, Insikt Group research demonstrates that this is a misleading assumption; the hacktivist landscape has consistently included actors reacting to regional events, and has also involved states operating under the guise of hacktivism to achieve geopolitical goals. In the last 10 years, the number of large-scale, international hacking operations most commonly associated with hacktivism has risen astronomically, only to fall off just as dramatically after 2015 and 2016. This constitutes a return to normalcy, in which hacktivist groups are usually small sets of regional actors targeting specific organizations to protest regional events, or nation-state groups operating under the guise of hacktivism. Attack vectors used by hacktivist groups have remained largely consistent from 2010 to 2019, and tooling has assisted actors to conduct larger-scale attacks. However, company defenses have also become significantly better in the last decade, which has likely contributed to the decline in successful hacktivist operations.
    [Show full text]
  • Training & Conferences
    WWW.ISSA - COS.ORG VOLUME 6 NUMBER 6 J U N E 2 0 1 7 Training & Conferences olleagues, Our first Security+ Exam Prep Review Seminar, held on April 1 and 8, was another Hard to believe, but we’re almost huge success – as it always is – thanks to C half-way through the year. Our the exceptional work by Susan Ross and our impressive team of volunteers has volunteer instructors. And our second dedicated much time and effort to bring a Security+ Seminar kicks off in just a few variety of events to our membership. This days! Each of these seminars provides a 12- chapter hosts a lot of amazing events, all hour comprehensive due to the efforts of our review of the CompTIA volunteers. Security+ exam material. Our first conference of A Note From Over 50 students the year, the Cyber Focus registered for these Day (CFD), was a huge Seminars! success! We had over 200 Our President We held eight people attend the one-day membership meetings, in conference, earning seven Jan, Feb, Apr, and May, continuing education units. four at lunchtime and four If you weren’t able to in the evening. If you attend CFD this year, you haven’t made it to our missed some great presen- monthly meetings, here’s tations! what you missed so far: Our Training Commit- tee held two Mini- By Ms. Colleen Murphy Airport Security, by Seminars, providing three Dr. Shawn Murray continuing education opportunities for each What Constitutes mini-seminar, with more Mini-Seminars on Reasonable Security?, by Mr.
    [Show full text]
  • Прогнозы На 2018 Год Kaspersky Security Bulletin: Прогнозы На 2018 Год
    Kaspersky Security Bulletin: ПРОГНОЗЫ НА 2018 ГОД KASPERSKY SECURITY BULLETIN: ПРОГНОЗЫ НА 2018 ГОД СОДЕРЖАНИЕ Введение .......................................................................................................3 APT-угрозы по прогнозам глобального центра исследования и анализа угроз (GReAT) ........................................4 Введение ..................................................................................................5 Оглядываясь назад ...............................................................................6 Чего ждать в 2018 году? ....................................................................7 Вывод ......................................................................................................20 Прогнозы по отраслям и технологиям ......................................21 Прогнозируемые угрозы в автомобильной отрасли ...... 22 Прогнозируемые угрозы в отрасли «подключенной» медицины ........................................................ 27 Прогнозируемые угрозы и мошеннические схемы в финансовой отрасли ......................................................31 Прогнозируемые угрозы в сфере промышленной безопасности ..................................................................................... 36 Прогнозируемые угрозы для криптовалют ...........................41 2 KASPERSKY SECURITY BULLETIN: ПРОГНОЗЫ НА 2018 ГОД ВВЕДЕНИЕ В 2017 году опытные злоумышленники и хактивисты продол- жили серию дерзких атак и краж, которые прогремели на весь мир. Но в этом году внимание СМИ было приковано
    [Show full text]
  • MALWARE PROPAGATION in ONLINE SOCIAL NETWORKS: MODELING, ANALYSIS and REAL-WORLD IMPLEMENTATIONS
    MALWARE PROPAGATION IN ONLINE SOCIAL NETWORKS: MODELING, ANALYSIS and REAL-WORLD IMPLEMENTATIONS Mohammad Reza Faghani A DISSERTATION SUBMITTED TO THE FACULTY OF GRADUATE STUDIES IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF DOCTOR OF PHILOSOPHY GRADUATE PROGRAM IN ELECTRICAL ENGINEERING AND COMPUTER SCIENCE (EECS) YORK UNIVERSITY TORONTO, ONTARIO June 2017 c Mohammad Reza Faghani, 2017 Abstract The popularity and wide spread usage of online social networks (OSNs) have attracted hackers and cyber criminals to use OSNs as an attack platform to spread malware. Over the last few years, Facebook users have experienced hundreds of malware attacks. A successful attack can lead to tens of millions of OSN accounts being compromised and computers being infected. Cyber criminals can mount massive denial of service attacks against Internet infrastructures or systems using compromised accounts and computers. Malware infecting a user's computer have the ability to steal login credentials and other confidential information stored on the computer, install ransomware and infect other computers on the same network. Therefore, it is important to understand propagation dynamics of malware in OSNs in order to detect, contain and remove them as early as possible. The objective of this dissertation is thus to model and study propagation dynamics of various types of malware in social networks such as Facebook, LinkedIn and Orkut. In particular, we propose analytical models that characterize propagation dynamics of cross-site • scripting and Trojan malware, the two major types of malware propagating in OSNs. Our models assume the topological characteristics of real-world social networks, namely, low average shortest distance, power-law distribution of node degrees and high cluster- ing coefficient.
    [Show full text]
  • Cisco 2017 Midyear Cybersecurity Report
    Cisco 2017 Midyear Cybersecurity Report 1 Executive Summary Table of Contents Executive Summary ..........................................................03 Vulnerabilities update: Rise in attacks following key disclosures ................................................................ 47 Major Findings ..................................................................05 Don’t let DevOps technologies leave the Introduction ......................................................................07 business exposed ............................................................ 50 Attacker Behavior .............................................................09 Organizations not moving fast enough to patch Exploit kits: Down, but not likely out ................................. 09 known Memcached server vulnerabilities ......................... 54 How defender behavior can shift attackers’ focus ...........11 Malicious hackers head to the cloud to shorten the path to top targets ..................................................... 56 Web attack methods provide evidence of a mature Internet ............................................................. 12 Unmanaged infrastructure and endpoints leave organizations at risk ......................................................... 59 Web block activity around the globe ................................ 13 Security Challenges and Opportunities Spyware really is as bad as it sounds............................... 14 for Defenders ...................................................................61
    [Show full text]
  • Protecting Iot Devices Against Ddos Attacks
    AntibIoTic: Protecting IoT Devices Against DDoS Attacks Michele De Donno1 Nicola Dragoni1;2 Alberto Giaretta2 and Manuel Mazzara3 1 DTU Compute, Technical University of Denmark, Denmark 2 Centre for Applied Autonomous Sensor Systems, Orebro¨ University, Sweden 3 Innopolis University, Russian Federation Abstract. The 2016 is remembered as the year that showed to the world how dangerous Distributed Denial of Service attacks can be. Gauge of the disruptiveness of DDoS attacks is the number of bots involved: the bigger the botnet, the more powerful the attack. This character, along with the increasing availability of connected and insecure IoT devices, makes DDoS and IoT the perfect pair for the malware industry. In this paper we present the main idea behind AntibIoTic, a palliative solution to prevent DDoS attacks perpetrated through IoT devices. 1 The AntibIoTic Against DDoS Attacks Today, it's a matter of fact that IoT devices are extremely poorly secured and many different IoT malwares are exploiting this insecurity trend to spread glob- ally in the IoT world and build large-scale botnets later used for extremely powerful cyber-attacks [1,2], especially Distributed Denial of Service (DDoS) [3]. Therefore, the main problem that has to be solved is the low security level of the IoT cosmos, and that is where AntibIoTic comes in. What drove us in the design of AntibIoTic is the belief that the intrinsic weakness of IoT devices might be seen as the solution of the problem instead of as the problem itself. In fact, the idea is to use the vulnerability of IoT units as a means to grant their security: like an antibiotic that enters in the bloodstream and travels through human body killing bacteria without damaging human cells, AntibIoTic is a worm that infects vulnerable devices and creates a white botnet of safe systems, removing them from the clutches of other potential dangerous malwares.
    [Show full text]
  • Designing an Effective Network Forensic Framework for The
    Designing an effective network forensic framework for the investigation of botnets in the Internet of Things Nickolaos Koroniotis A thesis submitted in fulfilment of the requirements for the degree of Doctor of Philosophy School of Engineering and Information Technology The University of New South Wales Australia March 2020 COPYRIGHT STATEMENT ‘I hereby grant the University of New South Wales or its agents a non-exclusive licence to archive and to make available (including to members of the public) my thesis or dissertation in whole or part in the University libraries in all forms of media, now or here after known. I acknowledge that I retain all intellectual property rights which subsist in my thesis or dissertation, such as copyright and patent rights, subject to applicable law. I also retain the right to use all or part of my thesis or dissertation in future works (such as articles or books).’ ‘For any substantial portions of copyright material used in this thesis, written permission for use has been obtained, or the copyright material is removed from the final public version of the thesis.’ Signed ……………………………………………........................... Date …………………………………………….............................. AUTHENTICITY STATEMENT ‘I certify that the Library deposit digital copy is a direct equivalent of the final officially approved version of my thesis.’ Signed ……………………………………………........................... Date …………………………………………….............................. 1 Thesis Dissertation Sheet Surname/Family Name : Koroniotis Given Name/s : Nickolaos Abbreviation for degree : PhD as give in the University calendar Faculty : UNSW Canberra at ADFA School : UC Engineering & Info Tech Thesis Title : Designing an effective network forensic framework for the investigation of botnets in the Internet of Things 2 Abstract 350 words maximum: The emergence of the Internet of Things (IoT), has heralded a new attack surface, where attackers exploit the security weaknesses inherent in smart things.
    [Show full text]
  • Antimalware to the Rescue
    MARCH 2014 INFORMATION EDITOR’S DESK: AS MALWARE ADVANCES, SO MUST ECURITY ANTIMALWARE S Insider Edition DEFENSE PLANS FEATURE: PROTECTION FROM ADVANCED MALWARE: WHAT ANTIMALWARE WORKS BEST? TO THE RESCUE InfoSec pros know they must detect and repel advanced FEATURE: HOW malware—but TO PUMP UP YOUR do they know ANTIMALWARE how? DEFENSES EDITOR’S DESK As Malware Advances, So Must HOME EDITOR’S DESK Antimalware Defense Plans WHY YOU MUST Stomping out malware would be lots easier if it just sat still. This Insider REVAMP YOUR BY BRENDA L. HORRIGAN ANTIMALWARE Edition helps make the fight against it more fair. STRATEGY WHAT ADVANCED MALWARE PROTECTION WORKS BEST? PUMPING UP YOUR ANTIMALWARE DEFENSE T’S GETTING HARDER for IT security pros to identify, offers insights on how to best assess the antimalware much less stop, the bad stuff trying to break into products currently on the market, which must include their enterprise. Modern malware is a shape-shifter, a careful weighing of costs and benefits. Finally, Spyro continually changing as it tries to squeeze past the Malaspinas demonstrates how to pump up your antimal- malware protection an enterprise already has in ware arsenal with supplemental products and tactics. place. Lately it’s even grown octopus legs, reaching up to It’s a sad fact of the modern world that, even as more Ithe highest levels of corporate networks but also down enterprises come to depend on antimalware products, into the smartphone of the newest entry-level employee. that protection’s effectiveness is steadily declining. But Advanced malware and its hacker-creators are prob- this doesn’t mean antimalware efforts are for naught: ing your system defenses right now; a revamp of your en- Rather, like modern malware, your efforts must shift and terprise’s antimalware strategies and systems can’t wait.
    [Show full text]
  • Antibiotic: Protecting Iot Devices Against Ddos Attacks
    AntibIoTic: Protecting IoT Devices Against DDoS Attacks Michele De Donno1 Nicola Dragoni1;2 Alberto Giaretta2 and Manuel Mazzara3 1 DTU Compute, Technical University of Denmark, Denmark 2 Centre for Applied Autonomous Sensor Systems, Orebro¨ University, Sweden 3 Innopolis University, Russian Federation Abstract. The 2016 is remembered as the year that showed to the world how dangerous Distributed Denial of Service attacks can be. Gauge of the disruptiveness of DDoS attacks is the number of bots involved: the bigger the botnet, the more powerful the attack. This character, along with the increasing availability of connected and insecure IoT devices, makes DDoS and IoT the perfect pair for the malware industry. In this paper we present the main idea behind AntibIoTic, a palliative solution to prevent DDoS attacks perpetrated through IoT devices. 1 The AntibIoTic Against DDoS Attacks Today, it's a matter of fact that IoT devices are extremely poorly secured and many different IoT malwares are exploiting this insecurity trend to spread glob- ally in the IoT world and build large-scale botnets later used for extremely powerful cyber-attacks [1,2], especially Distributed Denial of Service (DDoS) [3]. Therefore, the main problem that has to be solved is the low security level of the IoT cosmos, and that is where AntibIoTic comes in. What drove us in the design of AntibIoTic is the belief that the intrinsic weakness of IoT devices might be seen as the solution of the problem instead of as the problem itself. In fact, the idea is to use the vulnerability of IoT units as a means to grant their security: like an antibiotic that enters in the bloodstream and travels through human body killing bacteria without damaging human cells, AntibIoTic is a worm that infects vulnerable devices and creates a white botnet of safe systems, removing them from the clutches of other potential dangerous malwares.
    [Show full text]
  • Social Media As an Attack Vector for Cyber Threats
    Social Threats – Social Media as an Attack vector for Cyber Threats Stewart Cawthray General Manager, Enterprise Security Products & Solutions February 10, 2017 1 #WHOAMI • General Manager Security Products – Rogers Enterprise • 15 Year Security Veteran • Industry Speaker & Cybersecurity Evangelist • Devoted Father & Field Hockey Coach • Twitter: @StewartCawthray 2 Confidential & Proprietary #WhatWeDo Rogers Security Services Enterprise Cybersecurity Protection for Businesses of All Sizes 3 Confidential & Proprietary THE SOCIAL REVOLUTION 4 Confidential & Proprietary GLOBAL SCALE OF SOCIAL MEDIA 95% 3/4 US WORKING AGE ARE ACTIVE ON WORLDWIDE INTERNET USERS SOCIAL MEDIA HAVE ACTIVE SOCIAL PROFILES 5 Confidential & Proprietary IMPACT ON DAILY LIVES 27% 3 HOURS INTERNET TIME SPENT EVERY DAY SPENT ON ON SOCIAL MEDIA SOCIAL MEDIA 6 Confidential & Proprietary IMPACT ON ECONOMY 50% 25% OF AMERICAN’S LEVERAGE IS PINTEREST’S SHARE OF FACEBOOK FOR PURCHASE INTERNET RETAIL REFERRAL DECISIONS TRAFFIC 7 Confidential & Proprietary SOCIAL MEDIA THE BUSINESS PLATFORM Confidential & Proprietary 8 SOCIAL CREATES BUSINESS VALUE 40% Increase in performance for social brands vs. S&P 500 60% buying decisions made on perception of brand vs. product or service quality 9 Confidential & Proprietary MASSIVE INVESTMENT INTO SOCIAL Enterprise CMOs to spend 10.8% of marketing budget on social in next 12 months growing to 22.4% in five years. 57.5% are worried that use of online customer data could raise questions about privacy. Source – Duke Fuqua School of Business
    [Show full text]