DOCSLIB.ORG

2020 Data Breach Investigations Report DBIR Cheat Sheet 5 Summary Introduction of Findings

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
2020 Data Breach Investigations Report DBIR Cheat Sheet 5 Summary Introduction of Findings DBIR 2020 Data Breach 2020 Investigations Report 3,950 breaches That is what you are seeing. Each of these squares is organized by the 16 different industries and four world regions we cover in this year’s report. Each square represents roughly one breach (1.04 to be more exact), for a total of 4,675 squares since breaches can be displayed in both their industry and region. We also analyzed a record total of 157,525 incidents, 32,002 of which met our quality standards. The data coverage this year is so comprehensive that it shines through the monochromatic front cover, reinforcing the mission of the DBIR as being a data-driven resource. Turn the page to dig into the findings. Table of contents 01 03 05 DBIR Cheat sheet 4 Industry analysis 40 Regional analysis 86 Introduction 6 Accommodation and Food Northern America (NA) 90 Services (NAICS 72) 46 Summary of findings 7 Europe, Middle East and Africa (EMEA) 94 Arts, Entertainment and Recreation (NAICS 71) 48 Asia Pacific (APAC) 97 Construction (NAICS 23) 50 Latin America and the Caribbean (LAC) 101 02 Educational Services (NAICS 61) 52 Financial and Insurance (NAICS 52) 54 Results and analysis 8 Healthcare (NAICS 62) 56 06 Actors 11 Information (NAICS 51) 59 Actions 13 Manufacturing (NAICS 31–33) 61 Wrap-up 104 Threat action varieties 14 Mining, Quarrying, and Oil & Gas CIS Control recommendations 106 Extraction + Utilities Error 15 Year in review (NAICS 21 + NAICS 22) 64 109 Malware 16 Other Services (NAICS 81) 66 Ransomware 17 Professional, Scientific and Hacking 20 Technical Services (NAICS 54) 68 Social 25 Public Administration (NAICS 92) 71 07 Assets 27 Real Estate and Rental and Appendices 112 Leasing (NAICS 53) 73 Attributes 30 Appendix A: Methodology 114 Retail (NAICS 44–45) 75 How many paths must Appendix B: VERIS Common Attack a breach walk down? 32 Transportation and Framework (VCAF) 118 Warehousing (NAICS 48–49) 78 Timeline 35 Appendix C: Following the money— the key to nabbing the cybercriminal 120 Incident classification patterns and subsets 36 Appendix D: State of Idaho enhances incident response program with VERIS. 122 04 Appendix E: Contributing organizations 124 Does size matter? A deep 80 dive into SMB breaches Table of contents 3 DBIR Cheat sheet Hello and welcome to Variety: More specific enumerations of High Low Medium the 2020 Data Breach higher-level categories, e.g., classifying Industry labels Investigations Report (DBIR)! the external “bad guy” as an organized We align with the North American We have been doing this criminal group or recording a hacking Industry Classification System (NAICS) report for a while now, and we action as SQL injection or brute force. standard to categorize the victim appreciate that all the verbiage organizations in our corpus. The we use can be a bit obtuse at Learn more here: standard uses two- to six-digit codes to times. We use very deliberate classify businesses and organizations. naming conventions, terms • github.com/vz-risk/dbir/tree/gh- Our analysis is typically done at the and definitions and spend a lot pages/2020 includes DBIR facts, two-digit level. We will specify NAICS of time making sure we are figures and figure data. codes along with an industry label. consistent throughout the For example, a chart with a label of • veriscommunity.net features Financial (52) is not indicative of 52 report. Hopefully, this section information on the framework with as a value. “52” is the NAICS code will help make all of those examples and enumeration listings. for the Finance and Insurance sector. more familiar. • github.com/vz-risk/veris features The overall label of “Financial” is 0% 25% 50% 75% 100% 0% 25% 50% 75% 100% 0% 25% 50% 75% 100% the full VERIS schema. used for brevity within the figures. Detailed information on the codes and • github.com/vz-risk/vcdb provides Figure 1. Example dot plots classification system is available here: VERIS resources access to our database on publicly disclosed breaches, the VERIS https://www.census.gov/cgi-bin/ The terms “threat actions,” “threat Community Database. sssd/naics/naicsrch?chart=2012 actors” and “varieties” will be • http://veriscommunity.net/ referenced a lot. These are part of the veris_webapp_min.html allows you Vocabulary for Event Recording and have three different charts, each to record your own incidents and Dotting the charts and Incident Sharing (VERIS), a framework breaches. Don’t fret, it saves any representing common distributions we designed to allow for a consistent, data locally and you only share what crossing the confidence may find in this report. For convenience, Questions? Comments? Still mad unequivocal collection of security you want. Last year, we introduced our now we have colored the first half and the because VERIS uses the term “Hacking”? incident details. Here is how they (in)famous slanted bar charts to show second half differently so it’s easier to should be interpreted: the uncertainty due to sampling bias.1 locate the median. Let us know! Drop us a line at [email protected], find us on One tweak we added this year was to Incident vs breach In the first chart (High), you see that a LinkedIn, tweet @VerizonBusiness with the #dbir. Got a data Threat actor: Who is behind the event? roll up an “Other” aggregation of all the question? Tweet @VZDBIR! This could be the external “bad guy” We talk a lot about incidents and items that do not make the cut on our lot of companies had a very large value3 that launches a phishing campaign breaches and we use the following “Top (whatever)” charts. This will give associated with them. The opposite is or an employee who leaves sensitive definitions: you a better sense of the things we true for the second one (Low), where documents in their seat-back pocket. left out. a large number of the companies had zero or a low value. On the third chart Incident: A security event that Threat action: What tactics (actions) (Medium), we got stuck in the middle compromises the integrity, Not to be outdone this year, our were used to affect an asset? VERIS of the road and all we can say is that confidentiality or availability of an incredible team of data scientists uses seven primary categories of most companies have that middle value. information asset. decided to try dot plots2 to provide a threat actions: Malware, Hacking, better way to show how values Using the Medium chart, we could probably report an average or a median Social, Misuse, Physical, Error and Breach: An incident that results in are distributed. value. For the High and Low ones, an Environmental. Examples at a high level the confirmed disclosure—not just average is statistically undefined and are hacking a server, installing malware potential exposure—of data to an The trick to understanding this chart is the median would be a bit misleading. and influencing human behavior unauthorized party. that the dots represent organizations. through a social attack. So if there are 100 dots (like in each We wouldn’t want to do you like that. chart in Figure 1), each dot represents 1% of organizations. In Figure 1, we 1 Check “New chart, who dis?” in the “A couple of tidbits” section on the inside cover of the 2019 DBIR if you need a refresher on the slanted bar charts. 3 Don’t worry about what the value is here. We made it up to make the charts pretty. And don’t worry later either, we’ll use a real value for the rest of the dot plots. 2 To find out more about dot plots, check out Matthew Kay’s paper: http://www.mjskay.com/papers/chi2018-uncertain-bus-decisions.pdf 4 2020 Data Breach Investigations Report DBIR Cheat sheet 5 Summary Introduction of findings Experience is merely the Here we are at another edition of the process in order to improve how VERIS Figure 2. What tactics are utilized? Figure 3. Who’s behind the breaches? name men gave to their DBIR. This is an exciting time for us connects and interacts with other mistakes. as our little bundle of data turns 13 existing standards. We also aligned this year. That means that the report with the Center for Internet Security 45% of breaches featured Hacking 70% perpetrated by External actors —Oscar Wilde, The is going through a lot of big changes (CIS)4 Critical Security Controls and Picture of Dorian Gray right now, just as we all did at that age. the MITRE ATT&CK®5 framework While some may harbor deeply rooted to improve the types of data we can concerns regarding the number 13 and collect for this report, and to map them 22% included Social attacks Organized criminal groups were behind 55% of breaches its purported associations with mishap, to appropriate controls. misadventure and misfortune, we here on the team continue to do our best to A huge “thank you” is in order to each 22% involved Malware 30% involved internal actors shine the light of data science into the and every one of our 81 contributors dark corners of security superstition representing 81 countries, both those and dispel unfounded beliefs. who participated for the first time in this year’s report, and those tried-and- Errors were causal events in 17% of breaches Only 4% of breaches had four or more attacker actions With that in mind, we are excited to ask true friends who have walked this path you to join us for the report’s coming- with us for many years. This document, of-age party.
Load more

Recommended publications
  • Ransoming Government What State and Local Governments Can Do to Break Free from Ransomware Attacks About the Authors
    A report from the Deloitte Center for Government Insights Ransoming government What state and local governments can do to break free from ransomware attacks About the authors Srini Subramanian | [email protected] Srini Subramanian is a principal in Deloitte & Touche LLP’s Cyber Risk Services practice and leads the Risk & Financial Advisory practice for the State, Local Government and Higher Education (SLHE) sector. He has more than 30 years of technology experience, and more than 20 years of cyber risk services experience in the areas of information security strategy, innovation, governance, identity, access management, and shared services. Subramanian is a member of the National Association of State CIOs (NASCIO) Security and Privacy subcommittee. He is an active participant in the National Governors Association (NGA) Policy Council for State Cybersecurity formed in February 2013. Subramanian is the coauthor of the biennial Deloitte—NASCIO Cybersecurity Study publication with NASCIO since 2010. The recent two publications include the 2016 Deloitte-NASCIO Cybersecurity Study—State governments at risk: Turning strategy and awareness into progress and the 2018 Deloitte-NASCIO Cybersecurity Study—State governments at risk: Bold plays for change. Pete Renneker | [email protected] Pete Renneker is a managing director in Deloitte & Touche LLP’s Cyber practice and serves as the Technical Resilience Offering leader. In this capacity, his focus is on the development and delivery of cross-industry services which help clients develop the ability to withstand disruptions to critical business technology. This work includes helping clients respond to cyberattacks, accelerate business recovery from these events, and transform cyber and resiliency programs in anticipation of emerging threats.
    [Show full text]
  • COVID-19 Critical Infrastructure Cyber Threat Brief
    Digital Intelligence Securing the Future COVID-19 Critical Infrastructure Cyber Threat Brief CLIENT CONFIDENTIAL Cyjax Purpose This Cyber Threat Brief is intended to help mitigate the risk of cyberattacks against UK critical infrastructure during the coronavirus pandemic. We have defined critical infrastructure as: food supplies, medical supplies, transportation, security services, telecommunications, utilities and financial services. This report provides a broad overview of all relevant coronavirus-related digital threats, alongside more general vulnerabilities that attackers could exploit. We at Cyjax hope this will help organisations and their staff protect themselves from digital threats during this national crisis. If you require any further assistance or advice, please contact us. Overview of malicious cyber activity We have witnessed a significant uptick in cyberattacks exploiting fear of the coronavirus to compromise victims. Notably, however, there has not been a surge in the total number of attacks. Instead, existing cybercriminal operations have been rethemed with COVID-19 lures. Attackers have not gained more resources, but are instead repurposing their existing phishing, ransomware, and malware infrastructure to include COVID-19-themed keywords in a bid to infect more users. [1] All sectors are being targeted with COVID-19-themed attacks, including those operating in the critical infrastructure space. Attacks have ranged from generic “spray and pray” attacks to highly targeted advanced persistent threat (APT) operations. A broad array of nation-state actors have been involved from China, Russia, North Korea and Iran, among others. Sophisticated cybercriminals are also staging coronavirus-themed attacks. Most notably, organised ransomware gangs, who have continued to compromise, encrypt and leak data from a diverse group of organisations.
    [Show full text]
  • The Cyberpeace Institute Foreword 2 Acknowledgements 5
    March 2021 The CyberPeace Institute Foreword 2 Acknowledgements 5 Part 1: Setting the Scene 7 Disclaimer Introduction 9 The opinions, findings, and conclusions and recommendations in Signposting – How to read the Report 11 this Report reflect the views and opinions of the CyberPeace Institute Key Findings 15 alone, based on independent and discrete analysis, and do not indicate Recommendations 19 endorsement by any other national, regional or international entity. Part 2: Understanding the Threat Landscape 27 The designations employed and the presentation of the material in this publication do not express any opinion whatsoever on the part of the Chapter 1 Background 29 CyberPeace Institute concerning the legal status of any country, territory, 1.1 A convergence of threats to healthcare 29 city or area of its authorities, or concerning the delimitation of its 1.2 Healthcare as a target of choice 30 frontiers or boundaries. 1.3 Cybersecurity in the healthcare sector 32 Copyright Notice Chapter 2 Victims, Targets and Impact 35 2.1 A diversity of victims – the people 36 The concepts and information contained in this document are the 2.2 A typology of targets – healthcare organizations 38 property of the CyberPeace Institute, an independent non-profit 2.3 A variety of impacts on victims and targets 41 foundation headquartered in Geneva, unless otherwise indicated within the document. This document may be reproduced, in whole or in part, Chapter 3 Attacks 51 provided that the CyberPeace Institute is referenced as author and 3.1 Disruptive attacks – ransomware’s evolving threat to healthcare 52 copyright holder. 3.2 Data breaches – from theft to cyberespionage 57 3.3 Disinformation operations – an erosion of trust 59 © 2021 CyberPeace Institute.
    [Show full text]
  • An Introduction to Cybersecurity Ethics MODULE AUTHOR: Shannon Vallor, Ph.D
    An Introduction to Cybersecurity Ethics MODULE AUTHOR: Shannon Vallor, Ph.D. William J. Rewak, S.J. Professor of Philosophy, Santa Clara University TABLE OF CONTENTS Introduction 2-6 PART ONE: What are the important ethical issues in cybersecurity? 7-12 Case Study 1 13-15 PART TWO: Common ethical challenges for cybersecurity professionals 15-21 Case Study 2 21-24 Case Study 3 24-28 PART THREE: What are cybersecurity professionals’ obligations to the public? 29-34 Case Study 4 34-38 PART FOUR: What ethical frameworks can guide cybersecurity practice? 38-47 PART FIVE: What are ethical best practices in cybersecurity? 48-56 Case Study 5 57-60 Case Study 6 60-61 APPENDIX A: Relevant Professional Ethics Codes & Guidelines (Links) 62 APPENDIX B: Bibliography/Further Reading 63-65 1 An Introduction to Cybersecurity Ethics MODULE AUTHOR: Shannon Vallor, Ph.D. William J. Rewak, S.J. Professor of Philosophy, Santa Clara University 1. What do we mean when we talk about ‘ethics’? Ethics in the broadest sense refers to the concern that humans have always had for figuring out how best to live. The philosopher Socrates is quoted as saying in 399 B.C. that “the most important thing is not life, but the good life.”1 We would all like to avoid a bad life, one that is shameful and sad, fundamentally lacking in worthy achievements, unredeemed by love, kindness, beauty, friendship, courage, honor, joy, or grace. Yet what is the best way to obtain the opposite of this – a life that is not only acceptable, but even excellent and worthy of admiration? How do we identify a good life, one worth choosing from among all the different ways of living that lay open to us? This is the question that the study of ethics attempts to answer.
    [Show full text]
  • ESET THREAT REPORT Q3 2020 | 2 ESET Researchers Reveal That Bugs Similar to Krøøk Affect More Chip Brands Than Previously Thought
    THREAT REPORT Q3 2020 WeLiveSecurity.com @ESETresearch ESET GitHub Contents Foreword Welcome to the Q3 2020 issue of the ESET Threat Report! 3 FEATURED STORY As the world braces for a pandemic-ridden winter, COVID-19 appears to be losing steam at least in the cybercrime arena. With coronavirus-related lures played out, crooks seem to 5 NEWS FROM THE LAB have gone “back to basics” in Q3 2020. An area where the effects of the pandemic persist, however, is remote work with its many security challenges. 9 APT GROUP ACTIVITY This is especially true for attacks targeting Remote Desktop Protocol (RDP), which grew throughout all H1. In Q3, RDP attack attempts climbed by a further 37% in terms of unique 13 STATISTICS & TRENDS clients targeted — likely a result of the growing number of poorly secured systems connected to the internet during the pandemic, and possibly other criminals taking inspiration from 14 Top 10 malware detections ransomware gangs in targeting RDP. 15 Downloaders The ransomware scene, closely tracked by ESET specialists, saw a first this quarter — an attack investigated as a homicide after the death of a patient at a ransomware-struck 17 Banking malware hospital. Another surprising twist was the revival of cryptominers, which had been declining for seven consecutive quarters. There was a lot more happening in Q3: Emotet returning 18 Ransomware to the scene, Android banking malware surging, new waves of emails impersonating major delivery and logistics companies…. 20 Cryptominers This quarter’s research findings were equally as rich, with ESET researchers: uncovering 21 Spyware & backdoors more Wi-Fi chips vulnerable to KrØØk-like bugs, exposing Mac malware bundled with a cryptocurrency trading application, discovering CDRThief targeting Linux VoIP softswitches, 22 Exploits and delving into KryptoCibule, a triple threat in regard to cryptocurrencies.
    [Show full text]
  • North Korean Cyber Activity 03/25/2021
    North Korean Cyber Activity 03/25/2021 TLP: WHITE, ID# 202103251030 Agenda • DPRK National Interests • Timeline of Recent Activity • Overview of DPRK APT Groups • APT Threat Actor Profiles o HIDDEN COBRA o Andariel o APT37 o APT38 o TEMP.Hermit o TEMP.Firework o Kimsuky o Bureau 121 Bureau 325 o Slides Key: • Recommendations Non-Technical: Managerial, strategic and high- • Outlook level (general audience) Technical: Tactical / IOCs; requiring in-depth knowledge (sysadmins, IRT) 2 DPRK National Interests • North Korea, officially the Democratic People’s Republic of Korea (DPRK) • Supreme leader: Kim Jong-un (since 2011) • Primary strategic goal: perpetual Kim family rule via development of economy and nuclear weapons • Primary drivers of security strategy: o Deterring foreign intervention by obtaining nuclear capabilities o Eliminating perceived threats to Kim regime o Belief that North Korea is entitled to respect as a world power • “Cyberwarfare is an all-purpose sword that guarantees the North Korean People’s Armed Forces ruthless striking capability, along with nuclear weapons and missiles.” – Kim Jong-un (2013) • Reportedly has 7,000 cyber warriors • 300% increase in the volume of activity to and from North Korean networks since 2017 3 Timeline of Recent Activity Jan 2020 Feb 2021 Two distinct Aug 2020 Nov 2020 South Korean Feb 2021 clusters of USG exposed North Korean Intelligence North Korean DPRK cyber DPRK hackers claims DPRK Lazarus activity begin malware used targeted a targeted Group targeting in fake job major COVID- COVID-19
    [Show full text]
  • Global Threat Report Mid-Year 2021 Introduction
    Global Threat Report Mid-Year 2021 Introduction Threat actors are constantly adding to their repertoire by exploring new tactics and techniques to help bolster their efficacy against both technological blockers and humans. So far, this year has been no different as they have continued to add new methods to their toolchest. Thus far in 2021, we have observed several new techniques in the realm of customization as well as obfuscation. We will cover several examples in this report. We will also examine several consistent attack trends that continue to plague organizations across the globe. We are halfway through 2021 and one thing remains unchanged - email is still the number one attack vector for infecting organizations globally. Through the first half of 2021, phishing attacks continued their evolution with greater levels of sophistication. For the first time we observed attackers leveraging real web certificate data to add credibility to their attacks through customization. We also observed greater levels of obfuscation as some attacks threat actors went to great lengths to disguise the nature of their attacks. We observed phishing attacks leveraging CAPTCHA technology to avoid detection. Threat actors also continued the cycle of abuse by leveraging legitimate services to hide their intent. Job seekers and hiring functions within organizations were also targeted with phishing emails designed to mimic legitimate job sites. IC3 recently reported Business Email Compromise as the costliest of cybercrimes in 2020 with adjusted losses totaling $1.8 billion. It is not surprising we observed a large and growing volume of BEC attacks throughout Q1(’21) and Q2(’21) which show no signs of abating.
    [Show full text]
  • Report on Review of Contract Law: Formation, Interpretation, Remedies for Breach, and Penalty Clauses
    (SCOT LAW COM No 252) Report on Review of Contract Law: Formation, Interpretation, Remedies for Breach, and Penalty Clauses report Report on Review of Contract Law: Formation, Interpretation, Remedies for Breach, and Penalty Clauses Laid before the Scottish Parliament by the Scottish Ministers under section 3(2) of the Law Commissions Act 1965 March 2018 SCOT LAW COM No 252 SG/2018/34 The Scottish Law Commission was set up by section 2 of the Law Commissions Act 1965 (as amended) for the purpose of promoting the reform of the law of Scotland. The Commissioners are: The Honourable Lord Pentland, Chairman Caroline S Drummond David E L Johnston QC Professor Hector L MacQueen Dr Andrew J M Steven. The Chief Executive of the Commission is Malcolm McMillan. Its offices are at 140 Causewayside, Edinburgh EH9 1PR. Tel: 0131 668 2131 Email: [email protected] Or via our website at https://www.scotlawcom.gov.uk/contact-us/ NOTES 1. Please note that all hyperlinks in this document were checked for accuracy at the time of final draft. 2. If you have any difficulty in reading this document, please contact us and we will do our best to assist. You may wish to note that the pdf version of this document available on our website has been tagged for accessibility. 3. © Crown copyright 2018 You may re-use this publication (excluding logos and any photographs) free of charge in any format or medium, under the terms of the Open Government Licence v3.0. To view this licence visit http://www.nationalarchives.gov.uk/doc/open-government-licence/version/3; or write to the Information Policy Team, The National Archives, Kew, Richmond, Surrey, TW9 4DU; or email [email protected].
    [Show full text]
  • Ryuk 04/08/2021
    The Evolution of Ryuk 04/08/2021 TLP: WHITE, ID# 202104081030 Agenda • What is Ryuk? • A New Ryuk Variant Emerges in 2021 • Progression of a Ryuk Infection • Infection Chains • Incident: Late September Attack on a Major US Hospital Network • Incident: Late October Attack on US Hospitals • UNC1878 – WIZARD SPIDER • Danger to the HPH Sector • Mitigations and Best Practices • References Slides Key: Non-Technical: Managerial, strategic and high- level (general audience) Technical: Tactical / IOCs; requiring in-depth knowledge (sysadmins, IRT) 2 What is Ryuk? • A form of ransomware and a common payload for banking Trojans (like TrickBot) • First observed in 2017 • Originally based on Hermes(e) 2.1 malware but mutated since then • Ryuk actors use commercial “off-the-shelf” products to navigate victim networks o Cobalt Strike, Powershell Empire • SonicWall researchers claimed that Ryuk represented a third of all ransomware attacks in 2020 • In March 2020, threat actor group WIZARD SPIDER ceased deploying Ryuk and switched to using Conti ransomware, then resumed using Ryuk in mid-September • As of November 2020, the US Federal Bureau of Investigation (FBI) estimated that victims paid over USD $61 million to recover files encrypted by Ryuk 3 A New Ryuk Variant Emerges in 2021 • Previous versions of Ryuk could not automatically move laterally through a network o Required a dropper and then manual movement • A new version with “worm-like” capabilities was identified in January 2021 o A computer worm can spread copies of itself from device to device
    [Show full text]
  • Security Now! #789 - 10-20-20 Anatomy of a Ryuk Attack
    Security Now! #789 - 10-20-20 Anatomy of a Ryuk Attack This week on Security Now! This week we examine the coming controversial changes to the WebExtension API. We look at the revelations and fallout from last week's Patch Tuesday, and at Zoom's latest announcement of this week’s roll-out of end-to-end encryption. We make sure everyone knows about the latest horrific SonicWall vulnerability and Microsoft's pair of not-that-worrisome out-of-cycle patches. We share a bit of miscellany and closing-the-loop feedback. Then we examine an actual Ryuk Ransomware intrusion and attack... step-by-step. Browser News Edge to be updated with browser extensions “Manifest V3” The proposed changes to the WebExtensions API, generically known as “Manifest V3” were first announced by Google two years ago, in October 2018, for its Chromium project. And as we'll recall, Google's stated plans did not go over well. When Google announced their planned changes they said that the main intent was to improve extension security, improve extension performance and give users greater control over what extensions did and with which sites they could interact. But extension developers quickly pointed out that the “Manifest V3” updates contained changes that crippled the ability of ad blockers, antivirus, parental control enforcement, and various privacy-enhancing extensions to do their job as they had been. As a consequence, Google's announcement triggered a significant backlash from users, extension developers, and even other browser makers. Since, among other things, the extensions had the effect of limiting the power of ad blockers to block ads, the non-Google community was unhappy to see Google — an advertising-based company — moving to limit our ability to limit the ads our browsers subjected us to.
    [Show full text]
  • Quarterly Report on Global Security Trends
    Quarterly Report on Global Security Trends 3rd Quarter of 2020 Table of Contents 1. Executive Summary ............................................................................................................. 2 2. Featured Topics ..................................................................................................................... 4 2.1. Intensifying attacks on supply chains .................................................................... 4 2.1.1. Supply chain attack .............................................................................................. 6 2.1.1.1. Methods of supply chain attacks ................................................................. 6 2.1.1.2. Danger of supply chain attacks ................................................................. 10 2.1.2. Countermeasures against supply chain attacks ..................................... 11 2.1.2.1. Security measures in software development ....................................... 11 2.1.2.2. Security measures in service entrustment ............................................ 13 2.1.3. Conclusion ............................................................................................................. 14 2.2. Increase of double-extortion ransomware attacks ......................................... 15 2.2.1. Overall status of double-extortion ransomware attacks ....................... 15 2.2.2. Double-extortion ransomware attacks ........................................................ 16 2.2.3. How should we respond to double-extortion
    [Show full text]
  • Maze & Ryuk Ransomware Threat Assessment Report
    WHITEPAPER MAZE & RYUK RANSOMWARE THREAT ASSESSMENT REPORT TRU THREAT RECONAISSANCE UNIT Where we are right now INTRODUCTION Ransomware first entered the scene as a serious and categorical threat in May 2017. Since then, the new category has been an incredible money-maker for threat actors and multiple variations have been iterating non stop ever since. Chief Information Security Officers (CISO’s) and security teams across the globe have focused their efforts on detecting and deterring these destructive attacks. One trend, however, appears to be certain: Ransomware is here to stay, and both the virulence and velocity of these attacks are on the rise. Two new strains of Ransomware appear particularly troubling. Security On-Demand’s Threat Reconnaissance Unit (TRU) has published this Threat Assessment Report in an effort to help educate our community on better identifying indicators and providing guidance on a strategy to counter-act this threat. Unlike typical ransomware, which contain many behavioral commonalities in terms of how it proliferates, the Ryuk and Maze Ransomware strains are changing the landscape and we believe it to be a cause for concern as a new chapter unfolds. Let us examine the Ryuk Ransomware first. Ryuk Proliferation At this point in the lifecycle of a traditional THE RYUK ransomware attack, the ransomware would generally execute and immediately start encrypting folders and files. Such rapid execution decreases the likelihood of detection and this RANSOMWARE encryption process may be as quick as 30 seconds or multiple minutes. Regardless, Ryuk Security researchers have attributed Ryuk to is most successful when the device’s antivirus or the Wizard Spider threat group operating out of endpoint protection services failed to identify and Russia and Eastern Europe, which was first quarantine the threat on the endpoint or target observed in October 2018.
    [Show full text]