NAVIGATING THE THREAT LANDSCAPE A practical guide David Emm, Principal Security Researcher Global Research & Analysis Team, Kaspersky Lab www.kaspersky.com/business #SecureBiz Contents Chapter 1 The evolution of malware 3 Chapter 2 How malware spreads 9 Chapter 3 Malware: on the move as much as you are 12 Chapter 4 A new era of targeted attacks 14 Chapter 5 The human factor in security 15 Chapter 6 Anti-malware technologies 16 Chapter 7 Top tips for creating security awareness in your organization 19 About the author David Emm, Principal Security Researcher Global Research & Analysis Team (GReAT) David Emm is Principal Security Researcher at Kaspersky Lab, a provider of security and threat management solutions. He has been with Kaspersky Lab since 2004 and is currently part of the company’s Global Research & Analysis Team. He has worked in the anti-malware industry since 1990 in a variety of roles, including Senior Technology Consultant at Dr Solomon’s Software, and Systems Engineer and Product Manager at McAfee. In his current role, David regularly delivers presentations on malware and other IT threats at exhibitions and events, highlighting what organizations and consumers can do to stay safe online. He also provides comment to broadcast and media on the ever-changing cybersecurity and threat landscape. David has a strong interest in malware, ID theft and the security industry in general. He is a knowledgeable advisor on all aspects of online security. 2 Chapter 1: The evolution of malware It’s over 25 years since the first PC viruses appeared. Since then the nature of the threat has changed significantly and today the threats are more complex than ever before. In recent years, the Kaspersky Lab Global IT Risks Security concerns around these developments continue Survey has highlighted changes in working practices, to figure highly in the survey and, unsurprisingly, the all of which have had a significant impact on corporate 2015 results highlight that ‘preventing and dealing security. These include growing mobility and the with security breaches is a primary concern for 50% trend towards BYOD; the storage of business data of companies1 and guarding against cyberthreats is in the cloud; the increased use of virtualized systems; the top security priority for 27% of companies’.2 and the widespread use of social media at work. Dealing with security breaches is a primary concern for 50% of companies.1 TOP CONCERNS OF THE IT FUNCTION1 Dealing with security breaches, understanding new technologies and managing changes to IT systems are the primary concerns. Security breaches are a concern to companies of all sizes. By size Preventing/dealing with IT security breaches 50% Understanding the full range of new technologies E (1500+) 54% that are available and how to use them 44% Managing change in IT systems and infrastructure 42% MB (250-1499) 50% Making decisions about future IT investments 37% SB (50-249) 48% Dealing with cost constraints/limited budgets 31% VSB (1-49) 46% Training users how to use IT systems 26% Planning for and recovering from failure 22% or destruction of IT infrastructure Dealing with mobile working patterns and bring-your-own-device (BYOD) 18% Complying with industry regulations and standards 16% Managing wide range of different IT suppliers/product and service vendors 15% 1: Kaspersky Lab Global IT Risks Security Survey 2015 2: Kaspersky Lab Global IT Risks Security Survey 2015 3 COMPANY IT SECURITY PRIORITIES FOR THE NEXT 12 MONTHS2 Guarding against cyberthreats is now the top priority (previously third), supplanting preventing data leaks. Guarding against external cyberthreats such as malware 27% Fraud prevention 27% Preventing data leaks 25% Continuity of service of business-crtical systems 25% Security of cloud infrastructure (public and private) 22% Security of mobile/portable computing devices 21% Physical security of critical business systems 21% Eliminating vulnerabilities in existing systems 19% Security of virtualized infrastructure 19% Information security training provided to employees 19% Enhancing disaster recovery measures/planning 17% Compliance with industry/regulatory requirements 15% Improving response to information security incidents 14% Leveraging cloud-based or managed security services 13% Protecting against DDoS (distributed denial of service) attacks 12% Increasing in scale, increasing in severity The interconnected world means that attacks can be webpages, or download by a Trojan installed on an launched on victim’s devices very quickly, and as widely infected computer. or selectively as the malware authors and criminal underground sponsors require. The scale of the problem has also continued to increase. The number of new malware samples discovered daily Malicious code can be embedded in an email, injected by Kaspersky Lab runs into hundreds of thousands. into fake software packs, placed on ‘grey-zone’ 2: Kaspersky Lab Global IT Risks Security Survey 2015 4 A problem of perception In the past 12 months 90% of companies experienced But there’s a misconception that malware belongs some form of external attack and 46% of companies on its own, in a discrete category. In fact, malware reported an increase in the number of attacks3, although forms an essential component of many cyberattacks there is a perception that there were fewer instances and remains the most numerous and dangerous of data theft and obvious malware events in 2015. threat to IT security. Targeted attacks, cyberespionage, phishing attacks and more, all incorporate malware. So it’s not that malware attacks are declining, but that they may not be perceived as malware attacks. 90% of companies had experienced some form of external incident.3 EXTERNAL THREATS EXPERIENCED3 90% of companies had experienced some form of external incident. Fewer instances of theft and ‘obvious’ malware events in 2015 compared to previous waves. 65% 63% 61% 61% 59% 58% 57% 55% 54% 53% 40% 36% 36% 35% 33% 26% 28% 24% 24% 23% 22% 21% 20% 20% 19% 19% 18% 18% 15% 13% Spam Viruses, worms, Phishing attacks Network intrusion/ Denial-of-service Theft of mobile spyware and hacking (DoS), Distributed devices by external othe malicious denial-of-service party programs attacks (DDoS) Especially Especially IT, Education Financial services & Govt. 17% 16% 16% 13% 13% 13% 12% 11% 9% 9% 8% 7% 4% 4% 4% 3% 1% 1% Cyberespionage Theft of larger Targeted attacks aimed Criminal damage Point-of-sale (POS) Attacks on ATMs hardware specifically at our systems intrusion Especially organization/brand Manufacturing 5% among Especially Telecoms consumer services firms 2011 (n=1715) 2012 (n=2938) 2013 (n=2164) 2014 (n=2943) 2015 (n=3580) Significantly lower YOY 3: Kaspersky Lab Global IT Risks Security Survey 2015 5 From cyber-vandalism to cybercrime Until around 2003, viruses and other types of malware After 2003, the threat landscape changed. Much were largely isolated acts of computer vandalism – of today’s malware is purpose-built to hijack computers ‘anti-social self-expression’ using hi-tech means. and make money illegally. As a result, the threats Most viruses confined themselves to infecting other businesses now face have become significantly more disks or programs. complex. IT administrators have a lot more to contend with – there are more types of threats to protect against and the damage they cause is likely to be financial, not just ‘IT down-time’. 1 in 3 companies who’ve experienced a data breach event suffered temporary loss of ability to trade and typical direct costs incurred from a serious event are $38k for SMBs and $551k for enterprises.4 ESTIMATED DIRECT COSTS INCURRED RESULTING FROM ANY SERIOUS DATA LOSS INCIDENT4 Although not every expense is incurred by every business, we can nonetheless estimate a typical loss taking into account the likelihood of an organization incurring each expense. SMB Enterprise Potential cost Proportion of Potential cost Proportion of If experienced business incurring If experienced business incurring this expense this expense Professional Professional Services 88% Services 88% $11k $84k ‘Typical’ damage ‘Typical’ damage to SMBs from to enterprises from + a serious event + a serious event Lost business Lost business opportunities 32% $38k opportunities 29% $551k $16k $203k + + 2014 $33K 2014 $636K 2013 $36K 2013 $566K Down-time Down-time 34% 30% $66k $1.4m Each potential cost is multiplied by the likelihood to experience that cost then summed to find the expected overall ‘typical’ costs. 4: Kaspersky Lab Global IT Risks Security Survey 2015 6 New motives, new tactics The change in motive also brought about a change The main reason for the change is that attacks now in tactics. There was a decline in the number of global have criminal intent and look to steal confidential epidemics – designed to spread malware as far and as data, which can then be processed and used. Where quickly as possible. Attacks have become more focused. millions of victim machines are involved, detection is more likely and it creates a huge logistical operation. Therefore, malicious code authors now prefer to focus their attacks. Malicious code authors now prefer to focus their attacks. The rise of the Trojan Trojans are the most common type of malware today. They can be used to spy on victims. They can be used They are categorized according to their function: the to install additional malware to suit the needs of the most common include backdoors, password stealers, attackers. They can be used in DDoS (Distributed downloaders, and banking Trojans. Denial of Service) attacks on organizations: such attacks seek to extort money from organizations, using They are used to steal confidential information a ‘demonstration’ DDoS attack to give the victim a taste (username, password, PIN, etc.) for bank fraud. of what will happen if they don’t pay up. Holding you to ransom In recent years, there has also been a steady growth While anti-malware can detect ransomware, it may not in ‘ransomware’.