Weekly Security Roundup #37: Thinking One Move Ahead of the Opponent
Lateral thinking is a necessity when it comes to protection against cyber threats and attacks.
Outwitting the opponent– in this case cyber criminals – is the key to better defenses and improved response times in case of a data breach.
And they certainly keep the world on its toes.
The measure of our effectiveness as professionals will be evaluated across a wide range of indicators and that’s why we need to stay on top of the news and ahead of things.
I hope this weekly security roundup will help you do just that.
Security articles of the week
1. Fallen from grace: cyber security professionals discard antivirus as a reliable defense option and look for proactive solutions instead
Bromium announced the results of its “Enterprise Security Confidence Report” this week – a survey including over 125 information security professionals, which tackles the greatest risks that challenge organizations nowadays.
When asked to rank the effectiveness of various security solutions according to security architecture priorities, here is what the surveyed professionals said:
Which of the following technologies do you feel are ineffective security solutions?
Which of the following technologies do you feel are effective security solutions?
However, prevention-based technologies, such as threat isolation, that provide proactive protection are seen as foundational to security architecture and effective as defeating cyber attacks.
This brings us back to an older post we published which focused on: “Is Antivirus Dead? Meet The NextGen Anti-Hacking Tools“.
2. Taking down the “Apple products are immune to cyber attacks” myth
If the list of security updates released in the past few weeks by Apple doesn’t persuade you to start protecting your Apple device, then you should be prepared for the consequences.
Flaws and exploits are common to Apple products as well, so please stop thinking that you’re safe because you use a Mac or an iPhone.
3. The most wanted cyber criminals wanted have a $4,3 million on their heads
Cyber crime has real, serious consequences. If you need more proof, just at the crimes listed on these criminals’ records!
The FBI is not only looking for them, but also offering big rewards to those who will help capture some of the most skilled cyber criminals in the world.
4. Ransomware-as-a-service – the fuel behind the recent wave of cyber attacks
Our CEO discussed essential aspects of the malware economy last week and the subject is becoming an important one.
Vincent Weafer, Senior Vice President at Intel Security, recently shared his opinion on the matter in an article published on Dark Reading:
Cybercriminals have long been making their tools available to others, whether due to pride of authorship or as a means of raking in some extra cash. However, the ransomware-as-a-service model is relatively new and has resulted in a massive increase in ransomware attacks.
The cyber crime industry is growing, as we can all see, but we must remember that there’s always more going on below the surface than the eye can see.
5. Zeus-spawned banking malware families are wreaking havoc across the world
The Zeus GameOver network may have been taken down during Operation Tovar, but its variants still roam the web.
Dridex, Bebloh and TinyBanker are the strongest and most damaging malware families that target the financial sector with its products and services.
Just last week, a strong spam run was directed at spreading Dridex malware via infected email attachments.
Keep this Financial Data Protection guide at hand at all times and apply the recommendations we put together. It will help you conduct financial operations with more peace of mind.
6. Publicly announced cyber attacks are just the tip of the iceberg
No company wants to admit that they’ve experienced a cyber attack or suffered a data breach. So most of them prefer to handle things on the down low, which is why cyber attacks statistics are certainly inaccurate.
An article on Infosecurity Magazine sets up the problem for debate based on a recent survey:
A survey from Lieberman Software found that 87% of respondents think that large financial hacks are happening more often than reported, and right under the nose of security auditors.
The survey also discovered that more than half (51%) of IT professionals believe their corporate network is being targeted continuously by hackers.
Meanwhile, 71% of respondents think that an advanced persistent threat (APT) attack will attempt to breach their organization in the next six months.
Would disclosing the attacks help or would it damage the companies’ image even more – what do you think?
7. This guy will email you to tell if your password has been stolen
In the midst of all these negative reports, a positive piece of news is like a breath of fresh air!
According to the Naked Security blog:
One man emailed 97,931 people to tell them their passwords had been stolen
I’d say that this counts for at least 150.000 karma points!
8. A 3-part depiction of the cyber threat landscape in the European Union
Tim Rains, Chief Security Advisor at Microsoft Worldwide wrote a comprehensive article about the cyber security context in the European Union which was published in 3 parts on the Microsoft Cyber Trust Blog: Part 1, Part 2, Part 3.
As a preview, here are the locations in the EU with the lowest malware infection rates (CCM) in the last quarter of 2014:
9. Top hosting providers with the most phishing content
OpenDNS shared their findings related to the hosting providers who delivered – unknowingly and unintentionally – the most phishing content. Here’s a small preview:
Phishtank is a website run by OpenDNS where members submit potential phishes for review by other members of the community. When enough votes confirm a phishing attack, it is labeled as a verified phish. Phishtank is a relatively small slice of phishing content on the internet. We are only looking at a data set of just over 3 million reported phishing attempts.
10. Safe code is one of the best proactive security measures (but it’s not enough)
If cyber attacks are inevitable – and most cyber security specialists have confirmed that – then we must go to where it all begins and try to strengthen the defenses there.
Writing more secure code could help prevent security vulnerabilities and, consequently exploits that lead to cyber attacks and data leaks.
CISOs have to find security partners with experience in securing the application layer. This will allow secure coding practices to be injected in the earliest stages of the design process. The best practices and scans can be rolled out to a single development team first, to help iron out the process that best fits the specific organization, and then quickly scale up to the rest of the developers using the power of the cloud.
What’s one key thing you did to increase your security this week?
Let us help you out via our Cyber Security for Beginners course (it’s free) and you’ll surely be able to go on with your daily routine with more peace of mind.