The cybersecurity threat landscape
Barely a week goes by that we don’t see media coverage of a security breach at a household name, business, or institution. In their announcements and disclosures confirming such breaches, necessitated either by legal obligations or media pressure, victims invariably refer to the attack as a cyber incident. This obscures the true nature of what has happened and why.
In this section, we will explain the trends defenders face against attackers and dive into the facts and figures behind them.
Microsoft publishes its Digital Defense Report annually. The findings and statistics of the 2021 release make grim reading for defenders: Ransomware actors with budgets over $1 million for zero-day research or purchase. Continued commoditization of cybercrime, with marketplaces selling compromised devices and credentials for less than $1. This resulted in reportedly 72 billion endpoint, identity, and email threats blocked across Microsoft’s services.
Million-dollar budgets are a shock to many. Attackers with considerable levels of resources and the ability to succeed are referred to as Advanced Persistent Threats (APTs). They might be state-associated or criminal enterprises. With the rise of cryptocurrency and ransomware to receive extortion payments using it, there are big budgets due to big returns. Exact global figures are hard to ascertain, but in the United States, the Financial Crimes Enforcement Network (FinCEN) published that in the first half of 2021 alone, there was approximately $590 million reported in “ransomware-related” suspicious activity reports; a 41% increase on the entire preceding year.
How many other “industries” could cite such growth during a year most notable for the pandemic’s lockdown-induced economic difficulties? Of course, not all attacks are ransomware. Data compromise in general continues, with the likes of Magecart payment card theft being observed over two million times in a year, according to RiskIQ’s Magecart: The State of a Growing Threat (2019).
What services and infrastructure are these well-funded, highly motivated attackers compromising? Unsurprisingly, Windows tops the list of endpoints. Datto’s Global State of the Channel Ransomware Report (2021) reported that 91% of ransomware attacks targeted Windows-based clients. The attacks don’t stop at endpoints, though. The same report continues to note that a majority of the MSPs surveyed have also seen attacks in the cloud/software as a service, with 64% claiming attacks in Microsoft 365 and more than half reporting the same for Dropbox. From this report, we can also gain insights into how the attackers begin a breach; the root cause. Over half come from phishing emails, and one-fifth come from open Remote Desktop Protocol (RDP) access. Phishing emails largely gather user credentials and are then used for entry to attack systems or execute malicious attachments. Respondents to Proofpoint’s State of the Phish (2021) said that over half of successful phishing attacks resulted in a credential compromise. Verizon’s Data Breach Investigations Report (2021) advises that 23% of malware arrives on a system by email, continuing the trend of emails as an attack tool.
The prevalence of both open RDP access and phishing attacks is not particularly revelatory: any IT veteran will be familiar with the need to secure RDP and email. What many might not be familiar with, until it’s too late, is what happens next. We will explore this, in additional detail, in The cyber kill chain and MITRE ATT&CK section.
When it comes to responding to such threats, we see organizations struggling, particularly as they scale up. IBM Security’s Cost of a Data Breach Report (2021) notes an average of 212 days for breach identification and a further 75 for containment. Over 9 months! Even in organizations with incident response teams and capabilities, the average cost of a data breach is high, at over $3 million.
We know more organizations are trying to tackle these challenges by investing in such teams and cybersecurity resources. IDG’s State of the CIO (2022) reported that cybersecurity was the main driver of increased IT budgets. The report confirmed this comes from the top: a CEO’s top ask of CIOs is to improve the overall risk position by improving cybersecurity.
These stark numbers confirm the reality of the task defenders faces. In the next section, we’ll look at how attacks typically play out and how you can start to build systems against them. We will do this by reviewing popular cybersecurity frameworks.
