hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015About HP Security ResearchHP Security Research (HPSR) conducts innovative research in multiple focus areas. We deliversecurity intelligence across the portfolio of HP security products including HP ArcSight, HPFortify, and HP TippingPoint. In addition, our published research provides vendor-agnosticinsight and information throughout the public and private security ecosystems.Security research publications and regular security briefings complement the intelligencedelivered through HP products and provide insight into present and developing threats. HPSRbrings together data and research to produce a detailed picture of both sides of the securitycoin—the state of the vulnerabilities and threats comprising the attack surface, and, on the flipside, the ways adversaries exploit those weaknesses to compromise victims. Our continuinganalysis of threat actors and the methods they employ guides defenders to better assess riskand choose appropriate controls and protections.Our dataTo provide a broad perspective on the nature of the attack surface, the report draws on datafrom HP security teams, open source intelligence, ReversingLabs, and Sonatype.Key themesTheme #1: Well-known attacks still commonplaceBased on our research into exploit trends in 2014, attackers continue to leverage wellknowntechniques to successfully compromise systems and networks. Many vulnerabilitiesexploited in 2014 took advantage of code written many years ago—some are even decadesold. Adversaries continue to leverage these classic avenues for attack. Exploitation of widelydeployed client-side and server-side applications are still commonplace. These attacks areeven more prevalent in poorly coded middleware applications, such as software as a service(SaaS). While newer exploits may have garnered more attention in the press, attacks fromyears gone by still pose a significant threat to enterprise security. Businesses should employa comprehensive patching strategy to ensure systems are up to date with the latest securityprotections to reduce the likelihood of these attacks succeeding.Theme #2: Misconfigurations are still a problemThe HP Cyber Risk Report 2013 documented how many vulnerabilities reported were related toserver misconfiguration. The trend is very similar again in 2014, with server misconfigurationbeing the number-one issue across all analyzed applications in this category. Our findingsshow that access to unnecessary files and directories seems to dominate the misconfigurationrelatedissues. The information disclosed to attackers through these misconfigurations providesadditional avenues of attack and allows attackers the knowledge needed to ensure their othermethods of attack succeed. Regular penetration testing and verification of configurations byinternal and external entities can identify configuration errors before attackers exploit them.Theme #3: Newer technologies, new avenues of attackAs new technologies are introduced into the computing ecosystem, they bring with them newattack surfaces and security challenges. This past year saw a rise in the already prevalentmobile-malware arena. Even though the first malware for mobile devices was discovered adecade ago, 2014 was the year when mobile malware stopped being considered just a novelty.Connecting existing technologies to the Internet also brings with it a new set of exposures.Point-of-sale (POS) systems were a primary target of multiple pieces of malware in 2014. Asphysical devices become connected through the Internet of Things (IoT), the diverse natureof these technologies gives rise to concerns regarding security, and privacy in particular. Tohelp protect against new avenues of attack, enterprises should understand and know how tomitigate the risk being introduced to a network prior to the adoption of new technologies.4