In Collaboration With A PRACTICAL METHOD OF IDENTIFYING CYBERATTACKS February 2018 INDEX TOPICS EXECUTIVE SUMMARY 4 OVERVIEW 5 THE RESPONSES TO A GROWING THREAT 7 DIFFERENT TYPES OF PERPETRATORS 10 THE SCOURGE OF CYBERCRIME 11 THE EVOLUTION OF CYBERWARFARE 12 CYBERACTIVISM: ACTIVE AS EVER 13 THE ATTRIBUTION PROBLEM 14 TRACKING THE ORIGINS OF CYBERATTACKS 17 CONCLUSION 20 APPENDIX: TIMELINE OF CYBERSECURITY 21 INCIDENTS 2 A Practical Method of Identifying Cyberattacks EXECUTIVE OVERVIEW SUMMARY The frequency and scope of cyberattacks Cyberattacks carried out by a range of entities are continue to grow, and yet despite the seriousness a growing threat to the security of governments of the problem, it remains extremely difficult to and their citizens. There are three main sources differentiate between the various sources of an of attacks; activists, criminals and governments, attack. This paper aims to shed light on the main and - based on the evidence - it is sometimes types of cyberattacks and provides examples hard to differentiate them. Indeed, they may of each. In particular, a high level framework sometimes work together when their interests for investigation is presented, aimed at helping are aligned. The increasing frequency and severity analysts in gaining a better understanding of the of the attacks makes it more important than ever origins of threats, the motive of the attacker, the to understand the source. Knowing who planned technical origin of the attack, the information an attack might make it easier to capture the contained in the coding of the malware and culprits or frame an appropriate response. the attacker’s modus operandi. Nonetheless, attribution will continue to be difficult, which makes the study of the topic more urgent than Figure 1: Overview of common threat ever before. actors 4 A Practical Method of Identifying Cyberattacks A Practical Method of Identifying Cyberattacks 5 THE RESPONSES TO A GROWING THREAT In addition, there is a risk that a cyberattack may With this in mind, this paper describes some As governments and industries around the Also, according to the Computer Crime be misattributed or mistaken for a government- important cybersecurity-related events and world become digitally enabled, the number and Intellectual Property section of the US sponsored attack and spark a broader cyber their attribution. It goes on to offer different of cybersecurity-related events has grown Department of Justice, ransomware is the or physical war. Alternatively, a government- approaches that can be used to attribute a rapidly. It is worth providing some statistics fastest growing malware threat1, targeting sponsored hack may be disguised as a case large-scale and complex cybersecurity related on the scale of the problem, for organisations users of all types, from the home user to the of cyberactivism or cybercrime to avoid a event. Finally, it provides a framework for the and individuals to defend themselves from an corporate network. On average, more than government-to-government response. analysis of events related to cybersecurity to attack, and for the authorities to catch the 4,000 ransomware attacks have occurred daily help discern the difference among the types of perpetrators. in 2016. This is a 300-percent increase over the The classification of a cybersecurity event into cyberattack. approximately 1,000 attacks per day seen in different categories is mostly dependent on In 2016, Cybersecurity Ventures, a US research 2015. According to a PwC Global analysis of the motive for the attack. In cases in which firm, predicted that cybercrime will cost the economic crime, cybercrime is now the second the attack is motivated by political factors, the world $6 trillion annually by 2021, up from most reported economic crime, affecting more cyberattackers often have a strong interest in $3 trillion in 2015. The average cost to an than 32% of organisations worldwide2. hiding the real reason behind it. Alternatively, organisation of a data breach was $3.6 million, when the motive behind the attack is financial, based on a 2016 survey of 419 companies in 13 the actors behind it are less interested in disguising countries conducted by the Ponemon Institute, the motive than in making it difficult for law a US research firm. enforcement authorities to find the perpetrators. Given this complexity, different approaches need The global cost of the damage caused by one to be applied to identify the actors behind a form of cyberattack, ransomware, is predicted cybersecurity event. to exceed $5 billion alone in 2017, a 15-fold increase in two years, and is expected to This paper will provide examples of the different worsen. Ransomware attacks on healthcare types of cyberattacks and an analytical organisations-an industry which has been framework intended to help governments targeted by major ransomware campaigns in differentiate the source of such threats, even 2017-will quadruple by 2020. Cybersecurity though the tools of the attackers, the people Ventures predicts that a business will fall victim involved in the attacks and their target may be to a ransomware attack every 14 seconds by the same. 2019. 1https://www.justice.gov/criminal-ccips/file/872771/download 2https://www.pwc.com/gx/en/services/advisory/forensics/economic- crime-survey.html 6 A Practical Method of Identifying Cyberattacks A Practical Method of Identifying Cyberattacks 7 Furthermore, in the same report, PwC highlights Figure 3: Perception of the risk of an increase in public awareness of cybercrime. cybercrime (in comparison to 2014) This is mainly due to widely publicised and successful cyberattacks, and to the fact that many countries have enacted regulations forcing companies to report cyberattacks, even if the consequences of the attacks are not always made public. As a result of these changes in the threat environment, global spending by organisations and individuals on cybersecurity measures is expected to exceed $1 trillion over a period of five years to 2021, according to Gartner, a Demand for people with cybersecurity skills US research firm. The rising tide of cybercrime outstrips supply. Combatting cyberattacks will push spending on information security to will lead to more than triple the number of more than $86 billion in 2017, the firm predicts. unfilled cybersecurity jobs worldwide, which is This amount does not include some individual predicted to reach 3.5 million by 2021, according cybersecurity subcategories such as Internet of to CyberSecurity Ventures. In the US alone, Things (IoT), Industrial IoT, Industrial Control there were 350,000 cybersecurity job openings Systems (ICS) security and automotive security. in late 2017, compared with nearly 780,000 people employed in cybersecurity positions, As the world relies more on digital technology, according to CyberSeek, a project supported the size of the target for cyberattackers grows. by the National Initiative for Cybersecurity There are 3.8 billion internet users in 2017, just Education, a program of the National Institute of over half the world’s population, compared with Standards and Technology in the US Department 2 billion in 2015. Cybersecurity Ventures predicts of Commerce. there will be 6 billion internet users by 2022 and Figure 2: Cybercrime is the second most more than 7.5 billion internet users by 2030. reported economic crime Efforts to mitigate the risk of cyberattack are struggling to keep up with the threat. PwC 19th Annual CEO Survey 8 A Practical Method of Identifying Cyberattacks A Practical Method of Identifying Cyberattacks 9 DIFFERENT TYPES OF THE SCOURGE OF PERPETRATORS CYBERCRIME Most of the statistics that are publicly available 3. Activism: to protest against real or perceived Cybercrimes take a number of different forms. focus on the targets of attacks and the way they actions undertaken by governments, They include the theft of payment-related are carried out; very little analysis is conducted corporations or other entities. information (including credit card numbers and on the perpetrators and their motivations. other credit card data), such as a cyberattack This is because it is easier to observe the on more than 1,000 properties belonging to consequences of cyberattacks than to attribute Figure 4: Cybersecurity related events, the InterContinental Hotels Group that the classified by goals the sources of such events and the motives for company disclosed in April 2017. In that case, carrying them out. equipment at points of sale was compromised with malicious software designed to siphon out Cyberattacks on organisations (governmental customer debit and credit card data. or private) and on individuals fall under three main categories: In mid-2017, the US consumer credit reporting agency, Equifax, suffered a cyberattack that 1. Crime: to steal money from consumers, resulted in the leakage of personal information, companies or institutions, in a direct or indirect including social security numbers, belonging to way, using digital methods. This can include more than 145 million users. The information stealing payment information in order to buy could be used to open a fake bank account in a or sell goods, seizing the computational power person’s name or to request a loan or mortgage of a target in order to use it for one’s own by impersonating a legitimate account holder. advantage, and so on. Other types of cybercrime include the hacking Examples of these three categories are discussed 2. Warfare: to attack or otherwise destabilise a of personal, corporate or even national banking in the following sections of this paper. nation state or its institutions. In many cases, accounts to execute money transfers. One these events are acts of war, but they may example is the attack perpetrated against also include actions which are more indirectly Bangladesh Bank, the central bank of Bangladesh, aimed at spreading alarm or discontent in in February 2016, when instructions from the population or radicalising positions in the criminals to transfer $951 million were issued via domestic political debate.