2015 augurs newer, more devastating exploits on the unprepared
Connecting state and local government leaders
Big data, mobile and hybrid cloud technologies are creating challenging security environments for which half of organizations in a recent study had no disaster recovery plan.
If there’s any one thread that can be cultured from the cybersecurity stories of 2014, it has to be the increasing sophistication of attacks that are being made against both public and private organizations. That only looks to continue in 2015, with potentially staggering losses for the victims.
A recent study commissioned by EMC Corp., with research carried out in August and September last year, found that companies on average had lost 400 percent more data since 2012, with losses and downtime costing enterprises some $1.7 trillion.
The “good” thing was that the number of data loss incidents had decreased over time, though this was balanced by the fact that the volume of data lost in each incident “is growing exponentially.”
In what is becoming a core focus for cybersecurity, the report pointed out that a confluence of factors, including big data, mobile and hybrid cloud technologies – all of which are central to most organizations’ business plans – are creating new challenges for data protection.
And it seems many organizations are not ready for these inroads, with over half saying they have no disaster recovery plan for any of the three environments, and nearly two-thirds rating them as difficult to protect.
One of the more recent cyber attacks to be uncovered showed just how clever attackers have become and consequently how dangerous it is for organizations to be unprepared. At the same time that bad guys were siphoning off Sony Pictures secrets, Blue Coat researchers discovered new Android malware targeting high-profile victims in government, finance, military and engineering in at least 37 countries .
The techniques used in the attack are well beyond those typically seen in Android malware. They were designed to record the audio of mobile phone calls and, given the list of government and embassy targets, the attack, “appears to be a well-executed plan to get access to confidential or insider information from high-profile targets across critical sectors.”
This comes just weeks after the announcement of the Regin Trojan, another highly complex and very patient attack aimed at monitoring the phones and networks that use the Global System for Mobile Communications (GSM) standard, which has more than a 90 percent share of the world’s mobile market.
What’s clear is that the cyber threat ecosystem is becoming much more diverse and much deeper than in the past, with criminals as expert on some levels as the state-sponsored threats that have received so much press lately.
It’s also become much easier and cheaper for attackers to get hold of malware and cyber weapons they can use, with the rise of a professionalized marketplace for cybercrime tools and stolen data.
The high-profile Sony attack actually says little about what the future holds for cybersecurity. Whether North Korea, China or other state actors were or were not involved, it seems the attack itself was not highly sophisticated. The difference is that it was aimed at holding the company ransom over a film’s release rather than potential monetary gains targeted by other hig- profile attacks against Target, Home Depot and the like.
The Sony attack also succeeded because the company itself was unprepared, slow to detect it once it was underway and then slow to react and close it down. As the EMC report showed, if organizations are not prepared to ward off relatively simple attacks such as this, what is going to happen once the far more sophisticated and focused attacks on big data/mobile/cloud infrastructures, with their much greater potential payback, are let loose?
The story for 2015 and beyond will be what both public and private sector organizations can do to shore up their defenses against what attackers see as increasingly attractive, and highly vulnerable, targets.
NEXT STORY: Michigan builds identity proofing pilot