Magazine menu Close Magazine menu

trends

Latest stories

enterprise cybersecurity three questions for CISO

Three things business leaders should know about how IT security is changing

  • min read
    • From TV-on-demand to Pad Thai-to-your-desk, you can now get almost anything, any time, with a few taps on a screen. Companies give us personalized recommendations for today and anticipate what we'll want tomorrow. While it can be hard to meet ever-increasing customer expectations, technology is on the business's side. We can better target consumers, use data to make better decisions and deliver at low cost through digital channels. This growing number of technological windows to the world means business leaders must be cognizant of information security more than ever before. We asked over 300 Chief Information Security Officers (CISOs) from around the world how their role is changing. For detailed analysis, see our report Cybersecurity through the CISO's eyes: Perspectives on a role. These are three of the headline findings. 1.    Organization structures reflect cybersecurity's importance For evidence of the increasing importance of cybersecurity, look no further than organizational structure. IT and IT security are fast becoming separate departments in many businesses. Nearly a third (29 percent) of IT security leaders say not reporting to IT is the number one change in their role. Most think it's a change for the better. Separation from IT gives cybersecurity experts more independence and room for impartial judgment. However, the teams can't be completely independent. Some security essentials will stay as IT's responsibility, like patching, access control and configuring a secure infrastructure. The cybersecurity department also needs to know about all new IT initiatives to assess them in advance. Most CISOs say they have a good relationship with IT. Where there is conflict, it tends to be around who has the final say on things like deciding patch management routines, the level of flexibility and access for remote workers, and shutting down computers and servers during a possible breach. IT sometimes sees cybersecurity as a bottleneck because security requirements make it harder to launch new IT projects and maximize system performance. As one head of IT security told us, there's tension "between doing it securely, and just getting it done." What can we learn about organizational structure? For a supportive working environment, choose a structure that suits your business. Consider the level of maturity, budgets for IT and IT security, and the size of the workforce in each. Don't rush to set up IT security as its own department – you need to know they can cooperate first. It helps to have one executive to whom the heads of IT and IT security report. It could be the CEO or Chief Risk Officer. This person must make sure both teams make necessary compromises. 2.    Risk assessment needs insight, not just numbers Business today must balance exploring new opportunities and minimizing risk, including cybersecurity risk. Throughout their careers, IT security leaders have seen many measures for cybersecurity risk, such as threats blocked and issues patched. Metrics follow the 'use numbers, not IT security jargon' rule of communicating with business departments, but figures and charts alone don't tell you everything you need to know. What can we learn about good risk assessment? To know which cybersecurity risks could affect your business and how likely they are, enrich the numbers with qualitative analysis. Involve stakeholders like leaders of finance, sales and marketing in evaluating how identified threats affect the business. Their understanding of the main business objectives, such as to grow digital sales or start collecting more customer data, lets you set security priorities. Company leaders shouldn't just ask CISOs to calculate cybersecurity risk, but to share their broader business insight. 3.    Be realistic when hiring Around two thirds (70 percent) of CISOs said people shortages were a problem for them. When a new hire must start adding value right away, the CISO is tasked with finding a 'unicorn' with a unique skill set, instead of developing internal talent. With all the different technologies and solutions nowadays, few have all the skills and background. Even an experienced specialist needs two to three months to learn the company's policies, processes and nuances. Enterprises are often reluctant to train people with less experience because they may leave for a better-paid job. But there's no guarantee any skilled professional won't be offered a more interesting job with a higher salary, whether you're upskilling internally or hiring externally. What can we learn about hiring? Approve 'backup' vacancies in the information security department not related to urgent projects. Make sure newbies are mentored and given more than routine responsibilities like log reviewing. Give them the chance to learn something new and to grow professionally. These headline findings distill the wisdom of over 300 CISOs worldwide. Our focus was on how things are changing, but in many ways, they brought us back to basics. Enterprise security depends not only on implemented solutions but on well-tuned internal processes. Success doesn't wear a 'one size fits all' organization structure. It's in good communication between departments and in finding the knowledge behind the numbers. It's in hiring realistically and investing in the people you have today. This article was published in February, 2020.
security bytes 2020 plans

How will the cybersecurity industry evolve in 2020? Perspectives from InfoSec pros

  • min read
    • 2019 saw a rise in ransomware attacks on institutions, more cyberattack services from the Dark Web and data breaches galore. What will 2020 bring? The Security Bytes series is all about senior security professionals sharing their most savvy advice. Here, I ask several leading cybersecurity insiders: Anastasios Arampatzis, cybersecurity content writer for Bora "I constantly have the feeling we're failing. And we're failing BIG. No matter how many hours we spend writing, talking, presenting… the risk and threat of poor cybersecurity insight, data breaches and security incidents keep growing. Although cybercriminals do their worst, it's our own cybersecurity industry that fails to live up to our expectations. "Have you ever seen a security warranty for any technology product? Warranties only cover mechanical parts and not software-related ones. "So I hope in 2020, cybersecurity will change in two ways. "Firstly, the industry needs to embrace security-by-design and privacy-by-design frameworks. Existing legislation in many countries leans towards this. In the near future, I'd love to see a product with a security warranty so companies offering cyber-insurance won't be able to deny reimbursing their customers. "Secondly, I'd love to see cybersecurity becoming an integral part of the school curriculum, starting even from elementary schools. Let's see what goodies Cyber Santa will bring. Ian Anderson, Security Manager and Sec Ops "I see significant control system threats. Not just critical infrastructure like electric utilities or oil and gas, but also transport. The likelihood is low, but the impact could be enormous. "Cities and states have the least funding and resources to defend their networks and systems. Cyberattacks can affect water systems, emergency services and other civic services like public transport. We've already seen examples in Atlanta and Baltimore. Those cities were big enough to afford recovery. What would happen to smaller towns and cities?" Ian predicts positive change too. "We will see significant improvements to cloud security – improved tools, default settings and accompanying technologies that focus on keeping the organization's cloud-based systems secure. "End-user awareness is rising. InfoSec pros are generally getting better at detecting attempts at compromise. Initiatives like multi-factor authentication (MFA) and role-based access control mean phishing awareness campaigns are getting easier. I think users take some of these practices home, which means safer web access for families." I researched vulnerabilities in food manufacturing and power plant ICS (industrial control systems) and SCADA (supervisory control and data acquisition). I also observed reports of the city of Toronto's susceptibility to ransomware and data breaches in the wake of Atlanta's 2018 SamSam ransomware incident. So I think Ian's predictions are on the money. Cheryl Biswas, threat intelligence specialist "The 2020 US election is around the corner. Disinformation and deepfakes are worrying trends. Obfuscation and evasion tactics keep evolving, like hiding files in files, breaking them up across deliveries and renaming processes to make malware look legitimate to the operating system. I hope national DDoS attack mitigation systems have improved to withstand the next generation of botnets." Nation-state attacks will only get more intense. Industrial control systems and Internet of Things (IoT) devices are especially at risk. But since cybersecurity practitioners become more aware of the threat, I'm optimistic we can become better prepared. Sameep Agarwal, Information Security Consultant and Penetration Tester Sameep makes predictions for new surfaces we need to protect. "With the automotive industry bringing in remote vehicle administration and infotainment integration as standard, vehicles will become new targets for hackers. "Biometrics is another risk area. Mass fingerprinting data from biometric technology will be at risk of breaches. Cyberattackers may use in-body chip implants intended for geo-location, medical and psychological purposes to monitor people. "I foresee the disruption to food processing and manufacturing to cause mass damage and spoiling. Agriculture will be targeted in 2020, through automated, remote-monitored farming systems, all possible because of industrial IoT." The in-body chips worry me most. There are already IoT medical devices like pacemakers susceptible to cyberattack, and the number of IoT devices in people's bodies will increase. If we can understand the risks now, we can make medical IoT and augmented bodies more secure. Amin Hasbini, Head of Research, Kaspersky, Middle East "The 5G telecommunications revolution is imminent. This fifth-generation network will host more network-connected devices, increase speeds considerably for users and serve as the foundation for many futuristic technologies. "But the security concerns of 5G are inescapable. As an evolving and developing technology built on top of the previous 4G infrastructure, it will inevitably inherit vulnerabilities and misconfigurations. Large-scale distributed denial-of-service (DDoS) attacks could be amplified; the massive increase in the volume of connected devices, with all the uncertainties about their quality and security in the network, will be a challenging task for telco administrators. "5G will be a more complex environment compared to its predecessors. In a global supply chain setting, bans based on the nationality of a provider offer little assurance especially to countries that have adopted a "banned provider" as part of its vendor diversification process." Read more about Mohamed's predictions for 5G security. A more connected world is an efficient but inherently vulnerable one – how will we adapt? Kurt Waller, Cyber Intelligence Analyst Kurt's predictions seem reasonable to me. "I think targeted ransomware will be used to disrupt the supply chains of bigger organizations. "The same attack could use seemingly targeted sextortion (blackmail with private photos and videos) mixed with fake thumbnails, deepfake video and phishing. "Phishing and malware distribution methods will move to office documents that aren't macro-based." Sextortion is no laughing matter. Nobody should assume they're immune to that kind of abuse. What stands out? The common threads in these points of view from some of InfoSec's brightest stars give me pause for thought. What's the one issue above all others that will define cybersecurity in 2020? I'm most concerned by the expansion of IoT without proper security measures. We'll soon see the first car accidents caused by cyberattacks to self-driving vehicles. I'm optimistic that as an industry, we can prepare for the future of IoT. It has impressive potential, like fewer accidents from synchronized cars, or checking the performance of your pacemaker through a mobile app. The future of cybersecurity is making all these new technologies safer. Here's to a year ahead of working together to make the world a safer place. Article reflects the opinions of the author and speakers quoted. Published in 2020.

The worm has turned: What are the trends in malware today?

  • min read
    • In my daily work as a specialist malware analyst at Kaspersky, I'm often the first to come across and investigate the latest threats. I analyze lots of malicious software and explore the latest trends. Malware is a threat that's been here since almost the start of computing. And, sorry to say, it's here to stay. Every day, Kaspersky's cybersecurity systems process 346,000 new, previously unseen 'in-the-wild' samples. Within these, there can be well-known malware families but with some modification, so they hide from traditional antivirus products. In this article, I explain some of the growing threats I've seen in the last few years that could impact your business and how to prevent them. The difference between malware and threats Malware is a widely-used umbrella term for many types of threats caused by malware. But there's a difference: threats is a category wider than just malware. Threats include adware (programs that display adverts) which can be malicious, and riskware – legitimate programs that can be used to do harm in the wrong hands, like remote admin tools, password recovery and more. These threats aren't as dangerous as malware, but they're certainly causes of undesirable activity. Which countries have the highest malware infection rate? Kaspersky Security Network (KSN), a distributed antivirus network, uses a special metric that we call 'infection rate'. This shows what percentage of users in every country face different local threats from malware – found on computers or removable media such as flash drives, memory cards, mobile phones and network drives. For corporate users, the level of threats is, on average, 16 percent lower than for consumers. This is because users at work do less risky activities online, or face restrictive policies that prevent them from opening suspicious links and files. But the level of threat is still high: the top 10 countries for attacks have seen more than 42 percent of corporate users face local threats in the first six months of 2019. The most attacked countries are Uzbekistan, Afghanistan and Ethiopia. In the case of web-based threats, the rate for corporate users is relatively low at only six percent. These threats can emerge when different devices connected to computers become infected. Despite the low rate of infection, consequences can be costly. The countries most attacked are Venezuela, Algeria and Albania. What are the different classes of malware? Malware is divided into classes by its behavior and level of threat. At Kaspersky, we follow the rule that when a malware sample has several functionalities, the one with the highest risk is assigned. For example, if a newly discovered malware is able to steal passwords (Trojan-PSW) and has backdoor abilities, it will be named 'Backdoor', which means that it provides the author with remote admin of the victim's machine. Some people call all malicious software viruses but that's not correct: viruses have the ability to infect other applications on the victim's device. Worms are so-called as they have the ability to self-replicate and spread over the network. Trojans, unlike viruses and worms, are unable to make copies of themselves or self-replicate, but they are malicious programs that perform actions unauthorized by the user such as deleting, blocking, modifying or copying data, and they impair the performance of infected computers. Malware in 2019 – what classes pose the biggest threat? The worst offender so far this year? With a big head start, Trojans are the most proliferous threat, attacking 58 percent of corporate users. Next is Hacktool malware, which affected one in four. It's a class that includes software designed to bypass protection mechanisms, for example, cunningly disguised as a product activation tool. After that, DangerousObject (22 percent infection rate) which is connected with cloud detection technologies. Corporate users also face a dedicated type of malware: Trojan-Downloader. As its name suggests, it's a type of malware that can download files which infected one in 10 users. It's one of the top corporate threats because attacks are usually multi-staged: first, a small downloader is pushed (for example, by email), next, it downloads a second stage which can be the main malware itself or an exploit (a special code to exploit vulnerability in systems) to enable further attacks. 2017 to 2019: the threat landscape in review By analyzing the history of cybersecurity incidents, we see how much things fluctuate: one malware type can quickly become the latest hot trend for cybercriminals. Let's take a look at the trends that have dominated the threat landscape in the last three years: 2017 – the year of ransomware 2017 became the year of ransomware, with three unprecedented outbreaks transforming the landscape forever: WannaCry, ExPetr and BadRabbit. These attacks targeted businesses and used worms and leaked exploits to self-spread and encrypt data before demanding a ransom. The WannaCry epidemic affected hundreds of thousands of computers around the globe. The worm exploited a vulnerability in the Windows operating system implementation of the SMB protocol. After infecting a machine and executing a routine to spread further, WannaCry encrypted valuable files and displayed a ransom note. Full decryption of the affected files was impossible without paying the ransom – although our analysts discovered several flaws in WannaCry's code that allowed some victims to restore part of their data. The impact of WannaCry was brutal and global: carmaker Renault closed its largest factory in France and hospitals in the UK had to turn away patients. German transport giant Deutsche Bahn, Spain's Telefónica, the West Bengal power distribution company, FedEx, Hitachi and the Russian Interior Ministry were all hit. As a devastating high-profile attack targeting businesses, WannaCry was extremely successful. But as a ransomware plot to make lots of money, it was a failure – making only an estimated US $55,000 in bitcoins. Data loss can be a more costly threat: according to Kaspersky's 2017 annual IT security survey, 65 percent of businesses hit by ransomware lost access to a significant amount or even all of their data. 2018 – the rise of the miners 2018 began with a rise in miner-related attacks. A miner is a special program for generating cryptocurrencies. The miner loads the central processing unit or graphics processing unit of a machine as it performs lots of heavy operations to mine cryptocurrency. As a result, the performance of the machine decreases, and other tasks are performed slowly. Besides standard miners in the form of an executed file, in 2018 a new technique became prevalent: web-mining through a special script executed in a browser. The longer the user spends online, the more money the site's corrupt owner can earn from mining. There could also be legal cases where such scripts are used, when a user allows the site's owner to mine (for example, in the 'small print' of terms and conditions of the site) but the technology is misused and the user isn't properly notified. This rise of miners in 2018 even led to a decrease in DDoS (denial of service) attacks in the third quarter of 2018 as, supposedly, some botnets 're-profiled' from DDoS attacks to mining cryptocurrencies. There's a plethora of different distribution methods for mining include pirated software, social engineering, vulnerability exploitation and USB devices. Fortunately, mining incidents are now decreasing since the 2018 peak, but the volume of attacks is still high. Our user data shows that almost 80,000 corporate users were attacked by Trojan.Win32.Miner and its modifications – the most generic family for most of the malicious miners. It's not only anonymous miners who can attack your network from outside, sometimes the enemy comes from within. We've seen examples where an employee takes advantage of their position to gain access to their organization's network. 2019 – Banking malware, supply chain attacks and more During the last year, we've seen the number of cybercriminals stealing passwords on specialized forums stabilize. Trojans can steal passwords, credit card details and cookies saved in browsers. They're also capable of stealing files that are desired by cybercriminals. At Kaspersky, we track this activity with our Botnet Attack Tracking system and have seen that thieves usually targeted text or Microsoft Office files stored on desktops. This could be done to find credentials that users store in text files, or steal sensitive corporate information. Even though most of the attacks are targeted towards consumers (almost four times as frequently), corporate users can also become the victims. Another trend that emerged towards the end of 2018 was banking malware designed to steal user account data relating to online banking and eCommerce. The data is then transmitted to the malicious user controlling the Trojan. To perform an attack, malware is configured from a command and control server that contains a mask related to a banking service. Our data, however, showed that attacks on users in financial organizations decreased in 2018. We can explain this decrease with the unification of targets, so the masks become wider and can be applied to several services. Some bankers added cryptocurrency exchanges to the targets, so a user's credentials for the exchange can be stolen. There have been a lot of publicly available exploits for different vulnerabilities in the last two years. When I say exploit, I mean an illegal program or piece of code that can exploit a vulnerability in an operating system or application, like the ones used in the WannaCry campaign. Public disclosure of exploitation instruments of APT (advanced persistent threat) groups made it easier than ever before to penetrate, which could have led to new actors using this method. Publicly available exploitation tools are customizable and can be further improved by newcomer cybercriminals, so they can extend their attacks from poorly secured victims to branch out to more serious targets. Another trend we've seen recently is supply chain attacks which target small companies who provide bigger organizations with a product or service. MageCart went after users of Magento, one of the most popular online store platforms. Vulnerabilities found in Magento's platform gave cybercriminals the ability to infect dozens of sites. As a result, they could access a huge amount of payment card data that users had entered onto these sites. Victims included large companies like British Airways, who paid a record-breaking fine relating to the loss of customer data. This 'success story' inspired other cybercriminals, and now MageCart is attributed to several actors. I think this trend will continue, as plenty of large companies use third-party services, which can be less secure. How to protect your business from malware threats The threats related to malware will always be around, but it's definitely possible to improve the security of your corporate data. Here's my recommendations about how you can protect yourself and your business. Train your employees to be cyber-aware One of the top ways malware roots its way into your organization is through emails that trick employees to open a malicious attachment or go to a phishing web page. Advise employees to be wary of clicking on links in emails from people unknown to them and set restrictions on employee laptops to avoid the temptation for them to install illegitimate software. Consider launching a training program for employees to learn about basic cybersecurity hygiene and avoid mistakes. Give them the practical skills to apply to their day-to-day work in a delivery format that isn't too boring or laborious. I recommend using short engaging lessons based on a real-life event. Practice makes perfect. Regularly remind staff how important it is to follow cybersecurity rules. For example, place posters in the office or hand out take-away cards with simple and practical advice. Back up your data Always make backups of essential data to ensure corporate information is safe. If any information is damaged or encrypted, you can always recover it from the backup. Keep your systems secure Regularly update IT equipment, software and applications to avoid unpatched vulnerabilities that may allow malware to penetrate the corporate network. Use a dedicated endpoint security solution equipped with web and application control, anomaly control and exploit prevention components that monitor and block suspicious activity on the corporate network. It should include protection from ransomware, anti-phishing and anti-spam technologies. Enhance your existing security controls with threat intelligence to keep up-to-date with the new tactics, techniques and tools used by threat actors. For your security specialists, give them training on incident response, malware analysis and digital forensics to arm them with the knowledge they need to detect, analyze and respond to malware. Become cyber-immune And the good news? Corporate users are actually facing fewer threats in 2019 than they did last year. But the variety and severity of these threats is significant. The price of one mistake can be excessive: just one employee's infected machine could destroy the whole of your organization's systems. No one knows when the next threat will appear on the horizon or where it will come from – it's a case of when, not if. Keep up-to-date with the latest cybersecurity trends and focus on becoming cyber-immune, securing your entire infrastructure (including weak points like links to your suppliers' systems) so you're ready and prepared for the next WannaCry.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries