Today, IBM is revealing the results of its X-Force 2013 Mid-Year Trend and Risk Report, which shows that Chief Information Security Officers (CISO's) must increase their knowledge of the evolving vulnerability and attack landscape, such as mobile and social technologies, to more effectively combat emerging security threats.
For CISO's, it's no surprise that tried and true attack tactics can cause the most damage to an enterprise. Known vulnerabilities left unpatched in Web applications and server and endpoint software, create opportunities for attacks to occur. These unpatched applications and software continue to be facilitators of breaches year after year. However, the latest X-Force report also recognizes that attackers are improving their skills, which allows them to increase their return on exploitation. These attackers are capitalizing on users' trust when it comes to new vectors like social media, mobile technology and waterhole attacks.
Rise in Exploitation of Trusted Relationships
At the mid-year of 2013, attackers continue to focus on exploiting trusted relationships, via social networks from professional-looking spam, to sending malicious links that appear to be from friends or people that you "follow." These attacks do work, providing an entry point into organizations. In their defense, social networks have taken more proactive measures in pre-scanning links included in public and private posts/messages.
Criminals are selling accounts on social networking sites, some belonging to actual people whose credentials were compromised, others fabricated and designed to be credible through realistic profiles and a Web of connections. As a minimum they function to inflate page 'likes' or falsify reviews; though more insidious uses include hiding one's identity to conduct criminal activities - the online equivalent of a fake ID, but with testimonial friends, adding to the deception.
IBM X-Force expects to see applications of social engineering become more sophisticated as attackers create complex internetworks of identities while refining the art of deceiving victims. Technology advancements and controls are available, best practices continue to be refined and taught, but ultimately the trust the user believes they have may circumvent anything security practitioners put in place.
Poisoning the Waterhole
Attackers focusing on a central, strategic target like special interest Websites that are heavily frequented by a select group of potential targets are an effective and optimized means of exploitation. These central targets may not always have strong security solution and policies deployed, and even if they do, the cost of figuring out how to get through them is worth the opportunity to compromise the user-base.
These "watering hole" attacks are a great example of how operational sophistication is being used to reach targets not previously susceptible. By compromising the central site and using it to serve malware, attackers are able to reach more technically savvy victims who may not be fooled in phishing attempts, but would not suspect that sites they trust could be malicious.
Distraction and Diversion Techniques
Distributed-Denial-of-Service (DDoS) attacks can be used as a distraction, allowing attackers to breach other systems in the enterprise while IT staffs are forced to make difficult risk-based decisions, possibly without visibility of the full scope of what is occurring. Attackers have demonstrated enhanced technical sophistication in the area of DDoS using methods of increasing the amounts of capable bandwidth as an updated and powerful way to halt business by interrupting online service as well as new DDoS mitigation evasion techniques.
As the scope and frequency of data breaches continues in an upward trajectory, it is more important than ever to get back to basic security fundamentals. While technical mitigation is a necessity, educating users throughout the enterprise that security is a mindset, not an exception, can go a long way toward reducing these incidents.
About IBM Security
IBM provides the security intelligence to help organizations protect their people, data, applications and infrastructure. IBM operates one of the world's broadest security research and development organizations. IBM manages and monitors 15 billion security events every day for nearly 4,000 clients around the world and holds more than 3,000 security patents. Learn more about on IBM Security and IBM X-Force.
About The IBM X-Force Trend and Risk Report
The IBM X-Force Trend and Risk Report is an annual assessment of the security landscape, designed to help clients better understand the latest security risks, and stay ahead of these threats. In the first six months of 2013, IBM X-Force was able to:
- Analyze 4,100 new security vulnerabilities
- Scan 900 Million new Webpages and images
- Create 27 Million new or updated entries in the IBM web filter database
- Insert 180 Million new, updated, or deleted signatures in the IBM spam filter database
The report gathers facts from numerous intelligence sources, including its database of more than 73,000 computer security vulnerabilities, its global Web crawler and its international spam collectors, and the real-time monitoring of 15 billion events every day for approximately 4,000 clients in more than 130 countries. These 15 billion events monitored each day, are a result of the work done in IBM's 10 global security operations centers, which is provided as a managed security service to clients. Read the full X-Force 2013 Mid-Year Trend and Risk Report.
In addition, interested parties can attend the upcoming IBM X-Force Emerging Threats Road Show event. Just check out the events section of this site. Register now for this opportunity to hear the latest insights and learn how to protect and safeguard your organization with IBM's end-to-end security capabilities.
For CISO's, it's no surprise that tried and true attack tactics can cause the most damage to an enterprise. Known vulnerabilities left unpatched in Web applications and server and endpoint software, create opportunities for attacks to occur. These unpatched applications and software continue to be facilitators of breaches year after year. However, the latest X-Force report also recognizes that attackers are improving their skills, which allows them to increase their return on exploitation. These attackers are capitalizing on users' trust when it comes to new vectors like social media, mobile technology and waterhole attacks.
Rise in Exploitation of Trusted Relationships
At the mid-year of 2013, attackers continue to focus on exploiting trusted relationships, via social networks from professional-looking spam, to sending malicious links that appear to be from friends or people that you "follow." These attacks do work, providing an entry point into organizations. In their defense, social networks have taken more proactive measures in pre-scanning links included in public and private posts/messages.
Criminals are selling accounts on social networking sites, some belonging to actual people whose credentials were compromised, others fabricated and designed to be credible through realistic profiles and a Web of connections. As a minimum they function to inflate page 'likes' or falsify reviews; though more insidious uses include hiding one's identity to conduct criminal activities - the online equivalent of a fake ID, but with testimonial friends, adding to the deception.
IBM X-Force expects to see applications of social engineering become more sophisticated as attackers create complex internetworks of identities while refining the art of deceiving victims. Technology advancements and controls are available, best practices continue to be refined and taught, but ultimately the trust the user believes they have may circumvent anything security practitioners put in place.
Poisoning the Waterhole
Attackers focusing on a central, strategic target like special interest Websites that are heavily frequented by a select group of potential targets are an effective and optimized means of exploitation. These central targets may not always have strong security solution and policies deployed, and even if they do, the cost of figuring out how to get through them is worth the opportunity to compromise the user-base.
These "watering hole" attacks are a great example of how operational sophistication is being used to reach targets not previously susceptible. By compromising the central site and using it to serve malware, attackers are able to reach more technically savvy victims who may not be fooled in phishing attempts, but would not suspect that sites they trust could be malicious.
Distraction and Diversion Techniques
Distributed-Denial-of-Service (DDoS) attacks can be used as a distraction, allowing attackers to breach other systems in the enterprise while IT staffs are forced to make difficult risk-based decisions, possibly without visibility of the full scope of what is occurring. Attackers have demonstrated enhanced technical sophistication in the area of DDoS using methods of increasing the amounts of capable bandwidth as an updated and powerful way to halt business by interrupting online service as well as new DDoS mitigation evasion techniques.
As the scope and frequency of data breaches continues in an upward trajectory, it is more important than ever to get back to basic security fundamentals. While technical mitigation is a necessity, educating users throughout the enterprise that security is a mindset, not an exception, can go a long way toward reducing these incidents.
About IBM Security
IBM provides the security intelligence to help organizations protect their people, data, applications and infrastructure. IBM operates one of the world's broadest security research and development organizations. IBM manages and monitors 15 billion security events every day for nearly 4,000 clients around the world and holds more than 3,000 security patents. Learn more about on IBM Security and IBM X-Force.
About The IBM X-Force Trend and Risk Report
The IBM X-Force Trend and Risk Report is an annual assessment of the security landscape, designed to help clients better understand the latest security risks, and stay ahead of these threats. In the first six months of 2013, IBM X-Force was able to:
- Analyze 4,100 new security vulnerabilities
- Scan 900 Million new Webpages and images
- Create 27 Million new or updated entries in the IBM web filter database
- Insert 180 Million new, updated, or deleted signatures in the IBM spam filter database
The report gathers facts from numerous intelligence sources, including its database of more than 73,000 computer security vulnerabilities, its global Web crawler and its international spam collectors, and the real-time monitoring of 15 billion events every day for approximately 4,000 clients in more than 130 countries. These 15 billion events monitored each day, are a result of the work done in IBM's 10 global security operations centers, which is provided as a managed security service to clients. Read the full X-Force 2013 Mid-Year Trend and Risk Report.
In addition, interested parties can attend the upcoming IBM X-Force Emerging Threats Road Show event. Just check out the events section of this site. Register now for this opportunity to hear the latest insights and learn how to protect and safeguard your organization with IBM's end-to-end security capabilities.
