Cybercriminals have moved away from the sophisticated kinds of attacks we’ve seen in recent years. Today, they’re commonly using inexpensive, automated methods of intrusions, which have been very successful when used to target midsized organizations.
We recently released our 2016 Midmarket Threat Summary Report which analyzes threat types, volume, and preferred attack methods based on data gathered by our security analysts over the last year.
One of the key findings from the report was that today’s cybercriminals are moving away from high-risk, high-cost attacks to lower-level campaigns that can be prevented with basic security precautions.
“Cybercriminals are moving away from sophisticated malicious code attacks, with the majority of attackers preferring inexpensive and automated methods of intrusions, exploiting ‘low hanging fruit’.”
– 2016 Midmarket Threat Summary Report
Rudimentary attacks pose the greatest risk
According to the report, the most often observed threat categories were Intrusions Attempts, Information Gathering, and Policy Violations, which represented 63% of all observed attacks.
Here’s a brief description of each of these rudimentary threats, which are not always malicious by default, but are a strong indicator that an attack will likely occur.
- Intrusions Attempts: Activities that include attempts to compromise a system, application or authentication mechanisms by exploiting vulnerabilities, or weakness in a given system or its component (e.g. attacks against vulnerable browsers or servers).
- Information Gathering: Any activity that seeks to gather information, in a technical and non-technical way, about a user’s computer systems, open ports, protocols, services, or any combination. This activity does not directly result in a compromise, used to facilitate further exploitation (e.g. port scanning or networking mapping).
- Policy Violations: Any activities resulting from violation of an organization’s acceptable usage policies by an authorized user, but not related to other categories (e.g. Skype, remote desktop connections).
Low Risk, High Reward
In its most literal sense, a rudimentary attack is one that does not require a great deal of effort or resources. It’s simple. These attacks, which use automated tools and one-size-fits-all malware like ransomware allow hackers to extort money and data from businesses without exerting time and effort on specific, tailored attacks.
Small and midsized organizations are appealing targets because they don’t have the education or resources to protect themselves. Cyber-attackers are always going to look for something easy to exploit, hence the reliance on rudimentary methods that we observed.
What You Can Do
Many organizations – particularly those with limited resources – don’t know how to protect themselves against cyber-attacks. What our 2016 threat data indicates is that many attacks can be prevented with good security hygiene. You can reduce your organization’s threat surface by applying these three recommendations.
Make Patching a Daily Routine
Go back to basics. Many organizations want to improve their patch management practices, but it’s not an urgent priority. For example, organizations could have prevented the WannaCry attack if they applied the patch when it was released in March. Simply put, patching should be part of your daily routine, and done as fast as possible in order to defend against threats.
Re-evaluate and Re-tune Technologies
Many organizations are overwhelmed with the onslaught of new technologies – to the point where they’re too busy to go back and clean the house properly. Security controls need to be constantly re-evaluated and improved – which requires tuning, maintenance, administration and sufficient allocated resources.
Enforce your Acceptable Use Policy
The reality for most companies is that employees are the weakest link. That’s why developing and enforcing an acceptable use policy (AUP), which clearly defines for employees what they can and cannot do with corporate systems, is critical to containing risk. As the threat landscape evolves and employees increasingly expect freedom to use network resources as they please, it’s imperative that policies are updated and enforced on a regular basis.
One More Thing: Show That You Take Cybersecurity Seriously
Beyond these recommendations, there are measures you can take to minimize the costly effects of a cybersecurity breach. Many companies are moving beyond simply demonstrating that they have cybersecurity policies and procedures in place to showing that they’re updating them on a regular basis, and that they have supporting documentation (e.g. meeting minutes, policy documents) to stand as evidence in the event that a breach occurs. This can result in huge savings for organizations when it comes to litigation costs and insurance claims.
Taking a proactive approach to cybersecurity demonstrates to regulatory authorities, and your clients, that you’re adapting as quickly as the threat landscape is evolving.
