research Archives - Page 8 of 13 - Cyber Secure Forum | Forum Events Ltd
Posts Tagged :

research

Closing the gender gap in cybersecurity ‘could generate billions’

 960 640 Stuart O'Brien
By:
0
0

If the number of women working in cybersecurity rose to equal that of men, there would be a $30.4 billion boost to the industry’s economic contribution in the US and a £12.6 billion boost in the UK.

That’s according to a new report from Tessian, which also reveals that closing the gender pay gap, and equalising women’s salaries to men’s, could add a further $12.7bn and £4.4bn to the US and UK economies respectively. 

The report highlights the importance of encouraging more women into cybersecurity and identifies the barriers stopping this from happening. After surveying female cybersecurity professionals in the UK and the US, Tessian reveals that a lack of gender balance was far less of a barrier to entry in the UK, compared to the US:

·         82% of female cybersecurity professionals in the US believe that cybersecurity has a gender bias problem versus 49% of those in the UK. 

·         Just 12% of UK respondents say a lack of gender balance was a challenge at the start of their career versus 38% of those in the US.

·         US respondents were also three times as likely to believe that a more gender-balanced workforce would encourage more women to pursue roles in cybersecurity. 

The report sought to identify which other factors were discouraging women from joining the cybersecurity industry, and found that:

·         42% of respondents think a cybersecurity skills gap exists because the industry isn’t considered ‘cool’ or ‘exciting’. This opinion was most commonly shared by millennials – 46% vs. 22% of 45-54 year olds.

·         A lack of awareness or knowledge of the industry was the top challenge female professionals faced at the start of their career, with 43% citing this as a barrier.

·         43% of women said that a lack of clear career development paths was another challenge at the start of their cybersecurity career, while nearly a quarter (23%) cited a lack of role models.

·         Just 53% say their organization is doing enough to recruit women into security roles. 

Sabrina Castiglione, Senior Executive at Tessian said: “For organisations to successfully recruit more women into security roles, they need to understand what’s discouraging them from signing up beyond just gender bias. We need to make women in cybersecurity more visible. We need to tell their stories and raise awareness of their roles and experiences. And once through the door, managers need to clearly show women the opportunities available to them to progress and develop their careers.”

When asked what would encourage more women to consider a career in cybersecurity, over half (51%) said there needs to be more accurate representations of the industry in the media. Respondents ranked this as the number one way to encourage more women into cybersecurity, followed by a gender-balanced workforce (45%), cybersecurity-specific curriculum in universities (43%) and equal pay (28%).

In the report, Tessian interviewed Shamla Naidoo, former CISO at IBM who said: “To many people, cybersecurity equates to – and is limited to – someone in a hoodie bent over a keyboard in a dark room. That’s not the case at all. If we don’t expand beyond that, we’ll lose out on even more people in the industry.” 

In addition to huge economic benefits, there are other rewards for women working in cybersecurity. 93% of the women surveyed in the report feel secure or very secure in their jobs, with over half (56%) believing that cybersecurity is one of the most important industries today as cyber threats become more advanced. 

Read the full report and discover the stories of cybersecurity professionals at some of the world’s biggest organisations here: Opportunities in Cybersecurity 2020.

Global cybersecurity software revenue to hit $27bn in 2023

 960 640 Stuart O'Brien
By:
0
0

The overall cybersecurity software revenue is expected to reach $25.1bn in revenue this year, growing 4.8% year-on-year, with the entire market reaching $27bn in the next three years.

That’s according to data gathered by PreciseSecurity.com, which says the rising number of data breaches and cyberattacks globally, as well as the increasing awareness of the state-sponsored cyberattacks, have led to an increased demand for cybersecurity software solutions.

The report asserts that cybersecurity has become one of the biggest concerns for both citizens and businesses all around the world. The growing demand for eCommerce platforms, technology developments including AI and IoT, and the rising number of connected devices have led to the massive adoption of cybersecurity solutions.

For the purposes of the report, the cybersecurity software market refers to all software solutions aiming to protect individual computing devices, networks, or any other computing-enabled device. It includes antivirus software, management of access, data protection and security against intrusions, and any other system-level security risks, both in local installation and cloud service.

In 2012, the global cybersecurity software market reached $17.5bn in revenue. In the following seven years, the market revenue grew by nearly 40% to reach $23.9bn in 2019. The statistics indicate that the entire market is expected to grow at a CAGR of 2.5% in the next three years.

In global comparison, the United States is the leading cybersecurity software market in the world, with the report indicating the entire US market is set to reach $10.1bn value this year.

With $1.5bn value, or 6.5 times less than the US market, the United Kingdom ranked as the second-biggest market globally. The 2020 data show Germany is expected to reach $1.1bn market value this year, followed by France and Canada as other leading markets.

42% rise in companies reporting cyber attacks by foreign governments

 960 640 Stuart O'Brien
By:
0
0

In 2018, 19% of organisations believed they were attacked by a nation-state – That figure increased to 27% in 2019, with companies in North America the most likely to report nation-state attribution, at 36%.

That’s according to Radware’s 2019-2020 Global Application & Network Security Report, which found that more than one in four respondents attribute attacks against their organisation to cyber warfare or nation-state activity. 

“Nation-state intrusions are among the most difficult attacks to thwart because the agencies responsible often have significant resources, knowledge of potential zero-day exploits, and the patience to plan and execute operations,” said Anna Convery-Pelletier, Chief Marketing Officer at Radware. “These attacks can result in the loss of sensitive trade, technological, or other data, and security teams may be at a distinct disadvantage.”

Radware says the findings come at a time of heightened anxiety for security managers. Organisations are increasingly turning to microservices, serverless architectures, and a mix of multiple cloud environments. Two in five managers reported using a hybrid environment that included cloud and on-premises data centers, and two in five said they relied on more than one public cloud environment. However, only 10% of respondents felt that their data was more secure in public cloud environments.

As organisations adapt their network infrastructure to enjoy the benefits of these new paradigms (such as microservices and multi-cloud environments), they increase their attack surface and decrease the overall visibility into their traffic. For example, 22% of respondents don’t even know if they were attacked, 27% of those who were attacked don’t know the hacker’s motivations, 38% are not sure whether an Internet of Things (IoT) botnet hit their networks, and 46% are not sure if they suffered an encrypted DDoS attack. 

Convery-Pelletier added: “This report finds that security professionals feel as though the battlefield is shifting under their feet.  Companies are increasingly adding and relying upon new paradigms, like microservices, public and hybrid clouds, and IoT, which means the infrastructure is harder to monitor for attacks. These new technologies force a shift in security implementation into the development teams.  Security is often an afterthought as businesses march forward, and there is a misconception that ‘good enough’ is enough.”

In addition, the report also found:

The emergence of 5G networks. As the push for 5G grows, there exists an important opportunity to build security into networks at its foundations. Despite the increasing buzz around 5G networks, only 26% of carriers responded that they felt well prepared for 5G deployment, while another 32% stated that they were somewhat prepared.  

Be careful what you wish for in terms of IoT. 5G promises to advance organisations’ implementation of and the value they derive from IoT technologies, but that promise comes with a corresponding increase in the attack surface. When it comes to IoT connected devices, 44% of respondents said malware propagation was their top concern, while lack of visibility followed at 20% and Denial of Service at 20%.

Data loss is top concern. About 30% of businesses stated that data theft as a result of a breach was their top concern following an attack, down from 35% the previous year, followed by service outages at 23%.  Meanwhile, 33% said that financial gain is a leading motivation for attacks.

To read Radware’s ERT report, visit https://www.radware.com/ert-report-2020/

Is the search for data centre talent a threat, asks BCS

 960 640 Stuart O'Brien
By:
0
0

Continuing unprecedented growth in the datacentre sector is centre may be at risk due to increasing concerns around scarce resource and rising labour costs.

That’s according to the latest industry survey from Business Critical Solutions (BCS), a specialist professional services provider to the international digital infrastructure industry.

The Winter Report 2020, now in its 11th year, is undertaken by independent research house IX Consulting, who capture the views of over 300 senior datacentre professionals across Europe, including owners, operators, developers, consultants and end users. It is commissioned by BCS, the specialist services provider to the digital infrastructure industry.

Just over two-thirds of respondents believe that the next year will see an increase in demand, up on the 55% from our previous summer survey. This is supported by over 90% of developers and investor respondents stating they expect to see a further expansion in their data centre portfolio over the coming year.

However, concerns are being raised by many Design Engineering and Construction (DEC) respondents around general shortages amongst design, construction and operational professionals with four-fifths expressing resourcing concerns. DEC respondents identified build professionals as being subject to the most serious shortages – 82% stated this view compared with 78% for design professionals and 77% for operational functionality of data centres.

When asked to rank the impact of this our respondents highlighted the increased workload placed on their existing staff (96%),  rising operating/labour costs (92%) and over 80% indicating that this has led to an increase in the use of outsourcing options over the past 12 months. The increased workload for existing staff had in turn led to problems in resourcing existing work, with just over 70% stating that they had experienced difficulties in meeting deadlines or client objectives.

James Hart, CEO at BCS (Business Critical Solutions), said: “At BCS we are currently doing the round of careers fairs looking for candidates for next year’s graduate and apprenticeship scheme. When we are talking to these young people we often find that they either haven’t even considered our sector and/or they have misconceived ideas about what this career path involves. We can address this by going into universities, colleges and schools telling STEM graduates about the data centre industry and how great it is. Without action, this these issues will  become more acute, so the rallying cry for 2020 is that the sector is an exciting place to be and we have to get out there and spread the word!”

Hosted Security Landscape Report: Key insights for 2020

 960 640 Stuart O'Brien
By:
0
0

A new whitepaper has detailed market analysis of attitudes towards cloud adoption and purchasing behaviours behind hosted physical security from 1000 IT decision makers from across Europe.

The in-depth survey, undertaken by Morphean, a provider of hosted security solutions, illustrates a market that has overcome initial concerns about cyber-security, has understood the clear benefits and will be seeking to adopt such solutions at pace in 2020.

The independent survey of key decision makers within companies from UK, France and Germany with more than 50 employees clearly shows better security, cost benefit and better functionality to be the most influential factors and the most commonly realised benefits of hosted security solutions including video surveillance as-a-service (VSaaS) and access control as-a-service (ACaaS). These solutions are part of a cloud security market that is expected to grow from USD 4.1 billion in 2017 to USD 12.7 billion by 2022, at a CAGR of 25.5%.

The ‘2019 Landscape Report: Hosted Security adoption in Europe’ is the second study of its kind by Morphean, and facilitates a better understanding of market trends with comparative data from 2018. It revealed that 84% of IT managers are currently using (48%) or considering using (36%) a hosted security solution, which is broadly consistent with the 89% who said they would consider such a solution last year. It also shows that better security ranked #3 among the main benefits realised by the cloud (44%) compared to 27% in 2018; representing a 63% increase in the year and shift in perception around cyber security concerns.

2019 key survey findings include:

  • Better security, cost benefit and better functionality are viewed as the most influential factors AND the most commonly realized benefits of hosted security solutions 
  • Half of respondents cited better security as the #1 benefit of using VSaaS / ACaaS; better functionality (42%) and cost benefits (38%) placed #2 and #3 respectively
  • Half of IT managers have identified data / information security as a priority for improvement in the next 12 months
  • 84% of IT managers are currently using (48%) or considering using (36%) a cloud-based video surveillance or access control solution
  • Of those still considering VSaaS and ACaaS, 79% anticipate introducing these solutions to their business within 12 months
  • 77% of IT managers report that physical security is not optimized; 20% have identified physical security as a priority for improvement in the next 12 months

Rodrigue Zbinden, CEO, Morphean, said: “Our research clearly points to a market that is overcoming initial concerns about cybersecurity, understands the clear benefits of hosted services and reflects growing confidence and purchase intent for 2020. The increased appetite for hosted security presents an opportunity for us to work with businesses to help them improve their physical security, while also educating them on the potential business intelligence benefits offered by surveillance and access control solutions when integrated in the cloud.”

The growing confidence in cloud seems to translate into more positive purchasing intentions around hosted security solutions with 77% of IT managers reporting that physical security is not currently optimized and one in five identifying it as a priority for 2020. Of those considering hosted security solutions, 4 in 5 (79%) anticipate introducing them to their business within a year. While this clearly represents an opportunity for the IT reseller community to enhance its service offering, the report does highlight two trends that may inhibit growth; the first being the physical securityindustry’s ability to adopt the as-a-service business model; the second is system integration with emergent technology such as AI.

Alex Hilton, CEO of The Cloud Industry Forum, added: “With cloud technology we have a toolset that changes the way businesses think and act, ensuring a competitive landscape for years to come. Morphean’s latest research reveals that decision makers are seeing better security, cost benefits and improved functionality as a result of a switch to cloud-enabled security solutions. Cloud presents very real opportunities, but vendors need to hone their offerings and capabilities in order for its full potential to be realised across all markets and sectors.”

The Morphean survey also found that there has been a 5% drop in cloud investment over the past year. In 2018, 33% of the IT budget was spent on cloud services over the previous 24 months and this figure has dropped to 31.38% for 2019. This is in spite of the fact that the majority of respondents (78%) had said that they expected cloud related spending to increase due to the favourable benefits it presents. It’s not the only contradiction found in the report.

Cloud is key to driving operational performance, and yet 78% of IT managers felt that this area of the business was underperforming while only 36% identified it as a priority for improvement.

Barracuda: Growing confidence and emerging gaps in cloud security

 960 640 Guest Post
By:
0
0

For modern organisations, digital transformation is increasingly the only game in town. CIOs are turning to multiple cloud providers in droves for new app-based models, driving enhanced business agility to meet ever-changing market demands.

Yet security remains a constant challenge. Web applications themselves remain a major target for data theft and DDoS. A Verizon report from earlier this year claimed that a quarter of the breaches it analysed stemmed from web application attacks.

So, what are organisations doing about it? Chris Hill, RVP Public Cloud and Strategic Alliance International at Barracuda Networks reveals some interesting findings from its latest research…

Cloud maturity grows

The survey of over 850 security professionals from around the world reveals a growing confidence in public cloud deployments. Over two-fifths (44 percent) now believe public cloud environments to be as secure as on-premises environments, while 21 percent claim they are even more secure. What’s more, 60 percent say they are “fairly” or “very” confident that their organisation’s use of cloud technology is secure.

This makes sense. After all, cloud providers are capable of running more modern, secure infrastructure than many organisations could in-house. That means customers benefit from the latest technology, accredited to the highest security standards, versus heterogeneous, legacy-heavy in-house environments. As long as they pick the right third-party security partners and understand the concept of shared responsibility in the cloud, cyber risk can be mitigated effectively. The cloud even offers more options for backup and redundancy to further minimise risk.

Yet this isn’t the whole picture. Respondents to the study are still reluctant about hosting highly sensitive data in the cloud, with customer information (53 percent) and internal financial data (55 percent) topping the list. They complain of cybersecurity skills shortages (47 percent) and a lack of visibility (42 percent) as hampering cloud security efforts. And over half (56 percent) aren’t confident that their cloud set-up is compliant.

Could some of these concerns be linked to web application threats?

Websites under attack

The truth is that web apps are a ubiquitous but often poorly understood part of the modern cloud-centric organisation. As a business-critical method of delivering experiences to customers and productivity-enhancing capabilities to employees, web applications are a major target for cyber-criminals looking to steal sensitive data and interrupt key business processes. A Forrester study from 2018 found that the leading cause of successful breaches was external attacks — the most common of which focused on web applications (36 percent).

Fortunately, Barracuda Networks’ survey finds more than half (59 percent) of global firms have web app firewalls (WAFs) in place to mitigate these threats. The most popular option is sourcing a WAF from a third-party provider (32 percent), which makes sense, as long as they can protect customers from the automated bot-driven traffic that dominates the threat landscape. Not all can.

Patching and configuring

However, a greater concern is the fact that many organisations don’t appear to be taking the threat of web application vulnerabilities seriously. The Barracuda study found that 13 percent of respondents claim they haven’t patched their web application frameworks or servers at all over the past 12 months. Of those that did, it takes over a third (38 percent) of them between seven and 30 days to do so. For a fifth (21 percent), it takes over a month.

This is the kind of approach that landed Equifax in a heap of trouble when it failed to promptly patch an Apache Struts 2 flaw, leading to a mega-breach that has so far cost has over $1.4 billion. It’s an extreme example, but it is one that highlights the potential risks for businesses.

Another potential area of risk with web application environments is human error. A massive breach at Capital One earlier this year affected around 100 million customers and applicants, and it was blamed on a misconfiguration of an open source WAF.

Some 39 percent of respondents told Barracuda Networks they don’t have a WAF because they don’t process any sensitive information via their applications. But attacks aren’t just focused on stealing data. They can also impede mission-critical services. WAFs are certainly not a silver bullet. But as part of a layered approach to cybersecurity, they’re an important tool in the ongoing fight against business risk.

Conclusion

Growing cloud confidence is enabling digital transformations across organisations of every shape and size. However, that confidence comes with a cautionary tale. Attackers are also zeroing in on vulnerabilities and weaknesses that may have been ignored in the past, and many organisations are unaware of how these multi-layered attacks can unfold from a single access point. Web application security and cloud security posture are the key weapons customers need to deploy in order to continue their digital transformations safely in the cloud.

To ensure you are secure in the cloud, here are some tips:

• Ensure you have WAFs protecting all your apps. Don’t assume that just because an app doesn’t appear to have outside visitor engagement that it can’t be used as an attack vector. Once any vulnerabilities are discovered, attackers will exploit them, and it may help them gain access to your network and more valuable resources.
• Don’t leave application security in the hands of your development team. They aren’t security experts, nor do you pay them to be — you pay them to build great products.
• Deploy a cloud security posture management solution. Not only will this eliminate many security risks and failures, along with providing your development team with necessary guardrails to “build secure,” it greatly simplifies remediation and speeds investigations when issues do arise.

Global IT security market to hit $151bn in 2023

 960 640 Stuart O'Brien
By:
0
0

The size of the information security technology market could reach $151.2 billion in 2023, driven by the banking and telecoms sectors.

That’s according to a report from PreciseSecurity.com, which predicts spending in the security technology market will reach $106.6 billion this year. 

The report asserts that information security technology spending continues to move forward with large investments from different companies and organisations around the world, with the whole market growing by 57% 2018 and 2023 from $96.3 billion to $151.2 billion. 

The banking industry is one of the sectors that is expected to invest the largest amount of funds in this market.

“Considering there have been many attempts for hackers to acquire funds from banks, the banking industry is expected to spend the most on security solutions,” say the authors.

The report shows that the industries that will experience the fastest spending growth include government, telecommunications, and resources. They will be growing at a CAGR of 12.5%, 11.9% and 11.0% Compound Annual Growth Rate (CAGR), respectively. 

Although the growth in investment from companies and organizations in the security information technology market is expected to increase, the firms stresses its estimates could be conservative estimations. 

Justinas Baltrusaitis, the editor at PreciseSecurity.com, said: “Increasing investment in security products and services is a natural response to the growing number of various hacks and attacks companies experienced. In my opinion, this projection could be certainly realistic but I am not closed to think this number could be even higher.” 

Unwanted apps high on 2020 cyber threat list

 960 640 Stuart O'Brien
By:
0
0

So-called ‘fleeceware’ apps and aggressive adware software are among the key cyber threats posed to businesses and the public in 2020.

That’s according to the 2020 Threat Report, produced by SophosLabs to explore changes in the threat landscape over the past 12 months.

The Report focuses on six areas where researchers noted particular developments during this past year – here are the key findings:-

  • Ransomware attackers continue to raise the stakes with automated active attacks that turn organizations’ trusted management tools against them, evade security controls and disable back ups in order to cause maximum impact in the shortest possible time. 
  • Unwanted apps are edging closer to malware. In a year that brought the subscription-abusing Android Fleeceware apps, and ever more stealthy and aggressive adware, the Threat Report highlights how these and other potentially unwanted apps (PUA), like browser plug-ins, are becoming brokers for delivering and executing malware and fileless attacks.  
  • The greatest vulnerability for cloud computing is misconfiguration by operators. As cloud systems become more complex and more flexible, operator error is a growing risk. Combined with a general lack of visibility, this makes cloud computing environments a ready made target for cyberattackers.
  • Machine learning designed to defeat malware finds itself under attack. 2019 was the year when the potential of attacks against machine learning security systems were highlighted. Research showed how machine learning detection models could possibly be tricked, and how machine learning could be applied to offensive activity to generate highly convincing fake content for social engineering. At the same time, defenders are applying machine learning to language as a way to detect malicious emails and URLs. This advanced game of cat and mouse is expected to become more prevalent in the future. 

Other areas covered in the 2020 Threat Report include the danger of failing to spot cybercriminal reconnaissance hidden in the wider noise of internet scanning, the continuing attack surface of the Remote Desktop Protocol (RDP) and the further advancement of automated active attacks (AAA).

“The threat landscape continues to evolve – and the speed and extent of that evolution is both accelerating and unpredictable. The only certainty we have is what is happening right now, so in our 2020 Threat Report we look at how current trends might impact the world over the coming year.  We highlight how adversaries are becoming ever stealthier, better at exploiting mistakes, hiding their activities and evading detection technologies, and more, in the cloud, through mobile apps and inside networks. The 2020 Threat Report is not so much a map as a series of signposts to help defenders better understand what they could face in the months ahead, and how to prepare,” said John Shier, senior security advisor, Sophos.

For additional and detailed information on threat landscape trends and changing cybercriminal behaviours, check out the full SophosLabs 2020 Threat Report at https://www.sophos.com/threatreport. 

Research highlights cyber threat to schools

 960 640 Stuart O'Brien
By:
0
0

There have been 301 attacks against UK and US schools so far in 2019, compared to 124 in 2018 and 218 in 2017. 

That’s according to Barracuda analysis of data compiled by the K-12 Cybersecurity Resource Center (K-12 CRC), which has been tracking reported attacks against U.S. schools since 2016.

This only accounts for the reported cases, however, and Barracuda says it’s highly likely that additional cases exist that went either unreported or even undetected, especially as stealthier malware that seeks to steal information, participate in botnets, or mine cryptocurrency is on the rise.

The National Cyber Security Centre (NCSC) recently published a report compiling cybersecurity-related findings from 430 schools across the UK. It found that 83% had experienced at least one cybersecurity incident, even though 98% of the schools had antivirus solutions and 99% had some sort of firewall protection.

Using a single source of open threat intelligence data and a list of all known websites belonging to U.S. and UK schools, Barracuda researchers found 234 unique malware samples that attempted to connect to school domain names.

It also found 123 IPs associated with the same set of schools that had negative reputation, which could point to additional malicious activity, in addition to disrupting activity at the school due to emails and web pages being blocked.

Among the highlighted threats are:-

Cyberattacks Against Schools — The most common threats targeting schools are data breaches (31%), malware (23%), phishing (13%), network or school infrastructure hacks(10%), and denial-of-service attacks (4%), based analysis of the 708 incidents reported to the K-12 Cybersecurity Resource Center since 2016. The remainder of the incidents were made up of accidental disclosure of data (16%) and other incidents (3%). 

Barracuda says many school districts only have one or two IT personnel to service the district, let alone any dedicated cybersecurity staff. Plus, the steady increase in school-issued devices in recent years drastically expands the attack surface along with the number of systems that need to be secured. 

This, it says, makes schools largely a target of opportunity as well as subject to the massive campaigns spreading scams and malware indiscriminately. Lowered security postures due to budget constraints, combined with a large user base of minors who don’t have the critical-thinking skills to properly assess potential attacks, makes both types of attacks more effective, unfortunately.

How schools can protect against the threat

Barracuda says the only way for schools to truly protect against cyberattacks is a complete security portfolio including perimeter security, internal network security, incident response capabilities, and a knowledgeable security staff to configure these solutions and handle incidents:-

1. Perimeter security

Perimeter security generally consists of network firewalls, web filters, email protection, and application firewalls. While affordable and easy-to-configure solutions are available, obtaining the budget for a full security portfolio can prove difficult for many school districts, and without all areas covered, attack vectors will undoubtedly still exist. 

2. Internal network security

While internal security such as intrusion detection, data backup, and anti-malware solutions are important for catching any breaches in perimeter security, the additional risk of insider threats that schools face make these measures even more critical. While Windows Defender offers decent anti-malware protection these days, upgrading existing machines to Windows 10 to take advantage of this feature can be costly and is often overlooked by many organisations. Regardless of the software being used, though, keeping up with security patches is critical because it helps patch exploits that can potentially be leveraged by attackers. 

3. Incident response capabilities

In the event of an incident, intrusion detection and incident response solutions both assist in discovering incidents and helping security staff isolate and remediate them. Data backup as part of internal network security can also assist during an incident if data is corrupted, encrypted, or deleted.

4. Knowledgeable staff

Maintaining a capable IT security staff is challenging for many school districts because IT staffing needs often compete with other much needed positions, such as additional teachers to keep up with enrollment rates. Without this staff, though, it can be difficult to patch systems and respond to potential incidents or even properly configure security solutions to maximise their benefit. 

GUEST BLOG: The Growing DDoS Landscape

 960 640 Guest Post
By:
0
0

By Anthony Webb, EMEA Vice President at A10 Networks

A new wave of DDoS attacks on South Africa’s internet service provider has highlighted that these attacks continue to grow in frequency, intensity and sophistication.

A10 Networks’ recent report on the Q2 2019: The State of DDoS Weapons has shed more light on the loud, distributed nature of DDoS attacks and the key trends that enterprises can learn from in adopting a successful defence.

IoT: A Hotbed for DDoS Botnets

A10 Networks has previously written that IoT devices and DDoS attacks are a perfect match. With the explosion of the Internet of Things (growing at a rate of 127 connected devices per second and accelerating), attackers target vulnerable connected devices and have even begun to develop a new strain of malware named Silex- a strain just for IoT devices. Silex affected 1650 devices in over an hour and wiped the firmware of IoT devices in attacks reminiscent of the old BrickerBot malware that destroyed millions of devices back in 2017.

The report has highlighted the top-three IoT binary dropped by malware families – two of the three belonged to Mirai – with the Netherlands, UK, USA, Germany and Russia being the top five hosting malware droppers.

The New IoT Threat

A new threat has emerged due to industry-wide adoption of technology with weak security: the UDP implementation of the Constrained Application Protocol (CoAP). This new threat does not have anything to do with Mirai or malware, but its impact has enabled millions of IoT devices to become weaponised as reflected amplification cannons. CoAP is a machine-to-machine (M2M) management protocol, deployed on IoT devices supporting applications such as smart energy and building automation. CoAP is a protocol implemented for both TCP and UDP and does not require authentication to reply with a large response to a small request. A10 identified over 500,000 vulnerable IoT devices with an average response size of 749 bytes. The report also highlights that 98% of CoAP threats originate from China and Russia, with the capability to amplify by 35x.

On the Horizon: 5G

Ericsson recently predicted that the number of IoT devices with cellular connection will reach 4.1 billion by 2024. 5G, with its higher data speeds and lower latency, will be the primary driver behind this rapid expansion. Whilst this is great news in an open dynamic world, the downside is that we will also see an increase in the DDoS weaponry available to attackers.

We have seen mobile carriers hosting DDoS weapons skyrocket over the last six months. Companies such as T-Mobile, Guangdong Mobile and China Mobile have been guilty of amplifying attacks. With 5G, intelligent automation aided by machine learning and AI will become essential to detecting and mitigating threats. IoT devices by Linux are already the target of a new strain of malware which is predominantly dedicated to running DDoS attacks.

Amplified Attack

Amplified reflection attacks exploit the connectionless nature of the UDP protocol with spoofed requests to misconfigured open servers on the internet. Attackers send volumes of small requests with the spoofed victim’s IP address to exposed servers, which are targeted because they’re configured with services that can amplify the attack. These attacks have resulted in record-breaking volumetric attacks, such as the 1.3 Tbps Memcached-based GitHub attack in 2018, and account for many DDoS attacks.

Battling the landscape

Every quarter, the findings of our DDoS attack research point to one thing: the need for increased security. Sophisticated DDoS weapons intelligence, combined with real-time threat detection and automated signature extraction, will allow organisations to defend against even the most massive multi-vector DDoS attacks, no matter where they originate. Actionable DDoS weapons intelligence enables a proactive approach to DDoS defences by creating blacklists based on current and accurate feeds of IP addresses of DDoS botnets and available vulnerable servers commonly used for DDoS attacks. With DDoS attacks not going away, it’s time for organisations to match their attackers’ sophistication with a stronger defence, especially as new technology like IoT and 5G gains momentum.