According to the 2018 IBM X-Force Threat Intelligence Index, while the decline in breaches is a great result for everyone — except cyber criminals — there is still a long way to go with 2.9 billion records (down from 4 billion disclosed in 2016) reported breached and ransomware incidents alone costing organisations more than US$8 billion in 2017.
The IBM report found number of breaches dropped as cyber criminals shifted their focus to ransomware and destructive attacks that lock or destroy data unless the victim pays a ransom.
IBM says that while the number of records breached was still significant, ransomware reigned in 2017 as attacks such as WannaCry, NotPetya, and Bad Rabbit caused chaos across industries without contributing to the total number of compromised records reported.
• A historic 424% jump in breaches related to misconfigured cloud infrastructure, largely due to human error;
• For the second year in a row, the Financial Services industry suffered the most cyberattacks against it, accounting for 27% of attacks across all industries.
And in Australia, the trends are similar to the global security environment.
“The trends in Australia are in line with what we are seeing around the world. Globally we saw a 424% increase in records breached through misconfigurations in cloud servers,” says Pelin Nancarrow, IRIS Asia Pacific, IBM Security.
But Nancarrow says there are steps organisations in Australia can take to mitigate cloud configuration risks, including:
• Conduct a proper risk assessment on the cloud deployment you or your organisation uses so you can first understand where/if there are risks that need attention.
• Apply data confidentiality controls such as data encryption. If used effectively, this can minimise the impact in a case of leaked data.
• For enterprise customers contracting the services of a cloud provider, embed your security policies into the contract to ensure cooperation from your vendor.
• Use reliable threat intelligence sources to stay apprised of any new threats that may apply to your organisation and help you re-assess risk.
The IBM X-Force Threat Intelligence Index is comprised of insights and observations from data analysed via hundreds of millions of protected endpoints and servers across nearly 100 countries.
"While breached records are a good indication of cybercriminal activity, it doesn’t tell the full story of 2017," said Wendi Whitmore, global lead, IBM X-Force Incident Response and Intelligence Services.
"Last year, there was a clear focus by criminals to lock or delete data, not just steal it, through ransomware attacks. These attacks are not quantified by records breached, but have proven to be just as, if not more, costly to organisations than a traditional data breach. The ability to anticipate these attacks and be prepared will be critical as cybercriminals will continue to evolve their tactics to what proves most lucrative.”
IBM also reports:
• Ransomware attacks put pressure on incident response
Ransomware and destructive attacks, such as WannaCry, NotPetya, and Bad Rabbit, not only grabbed headlines in 2017, but also brought major organisations to a halt as cyber criminals took over and locked critical infrastructure in healthcare, transportation, and logistics, among others. Overall, ransomware incidents have cost organisations more than US$8 billion in 2017 as cyber criminals launched debilitating attacks that were focused on locking critical data instead of compromising stored records.
This trend puts increased pressure on organisations to be properly prepared with incident response strategies to limit the impact of an attack. An IBM Security study last year found that a slow response can impact the cost of an attack as incidents that took longer than 30 days to contain cost US$1 million more than those contained within 30 days.
• Human error remains a weak link
In 2017, cyber criminals continued to take advantage of human error and mistakes in infrastructure configurations to launch attacks. In fact, the report shows that inadvertent activity such as misconfigured cloud infrastructure was responsible for the exposure of nearly 70% of compromised records tracked by IBM X-Force in 2017. The report shows that there is a growing awareness among cyber criminals of the existence of misconfigured cloud servers. For example, 2017 saw an incredible 424% increase in records breached through misconfigurations in cloud servers.
Beyond misconfigured cloud, individuals lured via phishing attacks represented one-third of inadvertent activity that led to a security event in 2017. This includes users clicking on a link or opening an attachment laced with malicious code, usually shared via a spam campaign launched by cyber criminals. The report found that in 2017, cyber criminals relied heavily on the Necurs botnet to distribute millions of spam messages over a span of just a few days in some instances. For example, over a two-day period in August, IBM X-Force research observed four separate Necurs campaigns spamming 22 million emails.
• Cyber criminals find success targeting financial services customers
In years past, Financial Services has been the most targeted industry by cyber criminals. In 2017, it fell to the third-most attacked (17%) — behind Information & Communications Technology (33%) and Manufacturing (18%) — yet saw the most security incidents (27%) — those requiring further investigation — compared to other industries.
While Financial Services organisations have invested heavily in cyber security technologies to protect organisations, cyber criminals focused on leveraging banking trojans specifically targeting consumers and end users across the industry.
For example, the IBM X-Force Threat Intelligence Index report found that in 2017, the Gozi banking trojan and its variants were the most prevalently used malware against the Financial Services industry. The Gozi malware specifically targets customers as it takes over initial banking login screens with prompts for consumers to enter other personal information that is then shared directly with the attacker.
The use of Gozi, considered to be run by a skilled cyber crime operation, highlights how organised crime is overtaking all other classes of actors in the financial malware-facilitated fraud scene.