Study Reveals the Most Common Attack Methods of Data Thieves

Sophisticated criminals using advanced techniques are behind most of the recent security breaches, targeting small network openings and user weaknesses left vulnerable by even the latest shiny new technology. The painful reality is that security operations are struggling with the ever increasing number of threats and attack vectors, while trying to navigate the confusing landscape of security offerings. To add insult to injury, as operations is endeavoring to get its collection of security systems working together and defending every possible security gap, data thieves only have to find a single exploitable opening.

Our research report, A Thief’s Perspective, looks at the five attack methods that made up the majority of the almost 55 million attacks in Q1 2015. From browser blunders to denial of service, learning more about your attackers helps to improve your security profile and reduce the possibility of a breach. A related report surveyed security professionals on the security readiness of critical infrastructure; these professionals reported a high degree of confidence in their cyber defenses, even in the face of increasing threats. They also felt that increased cooperation between organizations, security vendors, and government agencies was critical to a successful cyber defense.

Interrupted Internet

Interrupting or denying access to Internet services remains the number one attack method, representing over 40% of all attacks. That is partially because this abuse of network resources is the easiest method, requiring only a few dollars in Bitcoin transactions to rent time on a distributed denial of service (DDoS) tool and flood a website with malicious traffic. Sometimes that is the whole attack, sometimes it is a deception tool to distract your security team while the real attack slips in unnoticed. Defenses against DDoS attacks have greatly improved, but they still rely on a solid understanding of normal volumes and patterns in order to quickly identify the beginnings of a DDoS flood, deep-packet and SSL inspection to understand the nature of the abusive packets, and powerful filtering to keep them away from your Internet resources.

When they want to actually get inside, thieves are still focused on users as the weakest point in your defenses. Whether it is from phishing emails, social engineering, or compromised websites, we have seen an 87% growth in suspect URLs in the last year, and browser-based attacks now make up over 35% of all attacks. Thieves are often focused on a specific department or a few key individuals, and will persistently target them until they get that one click they need. Not only is the number of malicious URLs growing rapidly, but thieves are also hiding their malware in feature-rich content such as Adobe Flash and JavaScript, making it harder to catch with static filters. Users need the added protection of intelligent content filtering that can emulate the browser functions to determine the true intent of any inbound scripting or multimedia file and dynamically adapt to user and attacker behavior.

Stealth Attacks

While the vast majority of attacks are knocking on the front door or trying to trick users with increasingly sophisticated Web lures, others are trying to sneak in by stealth, evade your defenses, or slip through in an encrypted stream. One of the big advantages attackers have is that they can analyze every aspect of your defenses, test various products, and try repeated approaches to figure out what might get through. They break malware up into small pieces for later reassembly, try to stay dormant during sandbox inspections, and randomize their callback addresses to get back-out. Finding these devious attacks requires collaboration from all of your defenses to correlate anomalous events and identify the malicious activities from the noise.

We believe that your information and systems can be protected, attacks can be detected, and breaches quickly corrected if we all act in concert. Information silos and shiny new toys will not reduce the number of threat vectors, but real-time information sharing and coordination between security defenses will significantly increase detection rates and reduce the time to contain and correct the situation if any manage to slip through. We need to change the way we think about security if we want a better prognosis about the realities of today’s threat landscape.