The Cyber Security Landscape: A Frightening Picture

A recent report by the Institute for Critical Infrastructure Technology (ICIT), a cyber security think tank that acts as a conduit between the private sector, US federal agencies and the legislative community, paints a frightening picture of the information security landscape.

The study, Rise of the Machines: The Dyn Attack Was Just a Practice Run, published in December 2016, shows just how vulnerable organisations are to the latest attack vectors. Corporate as well as government security executives need to understand what they’re up against when it comes to threats such as distributed denial of service (DDoS).

“The perfect storm is brewing that will pummel our nation’s public and private critical infrastructures with wave upon wave of devastating cyber-attacks,” the report notes. “The Mirai malware offers malicious cyber actors an asymmetric quantum leap in capability; not because of sophistication or any innovative DDoS code, rather it offers a powerful development platform that can be optimized and customised according to the desired outcome of a layered attack by an unsophisticated adversary.”

Script kiddies and cyber-criminal gangs are already drastically expanding their control over vulnerable Internet of Things (IoT) devices, which can be contracted in DDoS-for-Hire services by a virtually unlimited number of actors for use in an infinite variation of layered attack methods, the study says.

The brunt of the vulnerabilities on the Internet and in IoT devices rest with DNS, ISPs and IoT device manufacturers, “who negligently avoid incorporating security-by-design into their systems because they have not yet been economically incentivised and they instead choose to pass the risk and the impact onto unsuspecting end-users,” the report says. As a result of this, IoT botnets continue to grow and evolve.

As the adversarial landscape including nation state and mercenary bad actors, hacktivists, cyber-criminal gangs, script kiddies, and others continues to evolve, public and private data, intellectual property, and critical infrastructure continues to be pilfered and disrupted, ICIT says. The sectors at greatest risk for attacks include financial services, healthcare and energy.

The ICIT report presents a number of recommendations for organisations as they struggle to defend against the growing number of attacks. One is to develop actionable incident response plans. The key to an organisation’s survival in an increasingly hostile threat landscape is preparedness and forethought.

“At the moment, organisations have few technical options to mitigate DDoS aside from anti-DDoS service, endpoint security, and filtering rules,” ICIT says. “Instead, organisations can improve their security posture by developing an actionable and practiced incident response plan or standard operating procedure (SOP) for their personnel to follow in the event of an attack.” These plans ensure a chain of communication and command, and preclude short-term actions that could harm the organisation in the long-term.

Another step is to develop penetration tested IoT software and hardware featuring security-by-design. “Mirai demonstrates that rapidly developed or negligently developed IoT software and hardware can and will be leveraged for malicious purposes,” the report notes. “If IoT botnets are to be diminished and weakened in the future, IoT software and hardware must be developed with security-by-design.”

Device manufacturers do not include security-by-design due to lack of time, expertise and economic incentive. While some IoT and mobile software is developed in the US, most is developed or adapted abroad.

“Despite the possibility of regulatory measures from the United States and other nations, there is a strong likelihood that these constraints and the resulting manufacturer behaviors will remain unchanged,” ICIT says. “Rather than impose additional constraints on developers that will impact their already narrow profit margins, the cyber security community can build initiatives that promote the open source development and testing of IoT software.”

Training and policy are also critical. DDoS attacks are often distractions in multi-tiered cyber-attacks, in which the attacker aims to weaken network defenses or divert critical resources away from another attack vector while establishing persistent presence on the network, ICIT says. In other cases, botnets are used to deliver ransomware and other malware onto network systems.

Cyber security controls and basic training can greatly limit the number of network assets susceptible to botnet infection, the group says. This includes training on how to ignore social engineering lures, policies enforcing hardened system authentication controls at every interface, defensive measures against compromised certificates, reliance on data execution prevention and data loss prevention services, and other essential cyber security controls.

Finally, organisations need to begin holding device manufacturers accountable for security flaws. Mirai and other malware that infect IoT devices are designed to exploit weak security, default credentials, and hard-coded credentials and settings, ICIT says. Some manufacturers have begun to require complex credentials to be created upon activation of devices, while many others continue to distribute devices whose default or hard-coded credentials leave the devices vulnerable to infection.

Government contractors and private sector companies have the ability to refuse to engage with manufacturers that do not incorporate security by design into devices, ICIT says.

BusinesInsights:

How Cyber Attacks Will Get Worse In 2017:         Critical Cybersecurity Protocols To Implement:

 

« Indian Police Training To Crackdown On Electronic Fraud
GoggleBox: Moderate Screen Use 'Boosts Teen Wellbeing' »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ExaGrid Systems

ExaGrid Systems

ExaGrid provides Tiered Backup Storage with a unique disk-cache Landing Zone, long-term retention repository, and scale-out architecture.

Reed Smith LLP

Reed Smith LLP

Reed Smith LLP is an international law firm with offices in the USA, Europe, Middle East and Asia. Practice areas include Information Technology, Privacy & Data Security.

Boxcryptor

Boxcryptor

Boxcryptor encrypts your sensitive files before uploading them to cloud storage services.

HackCon Norway

HackCon Norway

HackCon is for the people who are interested in technology, psychology, IT and security, and who wants to improve their knowledge within these areas.

NSIDE Attack Logic

NSIDE Attack Logic

NSIDE Attack Logic simulates real-world cyber attacks to detect vulnerabilities in corporate networks and systems.

Communications Authority of Kenya

Communications Authority of Kenya

The Authority is responsible for facilitating the development of the information and communications sectors including; broadcasting, telecommunications, electronic commerce and cybersecurity.

Metrarc

Metrarc

Metrarc has developed a ground-breaking technology called ICMetrics™ for deriving secure encryption keys from the properties of digital systems without the need to store any of the encryption keys.

Global Cyber Security Capacity Centre (GCSCC) - Oxford University

Global Cyber Security Capacity Centre (GCSCC) - Oxford University

GCSCC's work is focused on developing a framework for understanding what works, what doesn’t work and why – across all areas of cybersecurity capacity.

IPification

IPification

IPification is a highly secure, credential-less, network-based authentication solution for frictionless user experience on mobile and IoT devices.

EVOKE

EVOKE

EVOKE is an award-winning Digital Transformation company that partners with its clients to build digital workplace solutions for organizational challenges.

Infopercept Consulting

Infopercept Consulting

Infopercept is a leading cybersecurity company in India, providing a critical layer of security to protect business information, infrastructure & assets across the organization.

Stratus Technologies

Stratus Technologies

Edge Computing solves the inherent challenges of bandwidth, latency, and security at edge locations to enable IIoT devices and data acquisition.

Smile Identity

Smile Identity

Smile Identity helps businesses confirm the true identity of their users in real-time using any smartphone or computer.

Supra ITS

Supra ITS

Supra ITS is a leading full-service technology partner offering IT Consulting, Cloud Services, 24x7 Managed IT & Cybersecurity Services, and IT Project Support.

Mindgard

Mindgard

The Mindgard Security Copilot platform secures your Artificial Intelligence, GenAI and LLMs.

DNSFilter

DNSFilter

DNSFilter is the most accurate threat detection and content filtering tool on the market today.