hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015The security conversationReflecting on the 2014 threat landscape we undertook a broad top-level look at public securityresearch and analysis published in 2014, using key word analytics targeting specific concepts.As befitting a look at high-profile trends, our data was drawn strictly from sources available onthe public Internet. The first set of data was drawn from the press covering the industry as wellas other sources. We drew the second set from content presented at industry conferences suchas BlackHat, DefCon, and Virus Bulletin. The yearly Cyber Risk Report is time-bound and so weresolved to do a time-oriented analysis.“Malware” was thetop key word of 2014, outstripping even“security” as a favored key wordWorking within that dataset, we analyzed two sets of terms for their frequency of appearance.The first set, the key words, are the security-associated words more familiar to a generalaudience; for instance, attack, threat, or targeted. These terms are also more likely to appeal toheadline writers, because what they lack in specificity they make up for in brevity and “oomph.”The second set, the key phrases, describe more granular and complex concepts that tend tobe used mainly by security practitioners. Exploit kit and C&C server are two examples of keyphrases. This distinction allowed us to approach the data in a progression from less to morespecificity. Between the two, we started our analysis with approximately 10,000 words andphrases we found to be of interest.Our first dive, “total 2014+2013,” looked at which topics rose and fell in the English-languagetrade press over the last 24 months. If we assume that trade journalism is a good mirror ofwhat’s actually happening in the real security world, it should follow that the frequency of keywords and key phrases in the press is a good indicator of what those in the industry arethinking about.One of the strengths of Big Data is its predictive power. From our 2013+2014 results, we madelinear extrapolations to see what might lie ahead in 2015, assuming that what is rising willcontinue to rise and what is falling will continue to fall.Our analysis indicated that breaches and malware were weighing heavily on our minds in 2014.“Malware” itself was the top key word of 2014 (and of 2013), outstripping even “security” asa favored key word and making bold progress among security practitioners as part of thekey phrase “malware family.” Key phrase analysis indicated that conversation about mobilemalware, particularly Android malware, was rising even as the more neutral phrase “mobiledevices” fell. The efficacy of anti-malware software was debated in 2014, but the analysisindicates that malware as a hot topic isn’t going anywhere anytime soon.Digging a bit deeper, we returned to our lists of key words and key phrases and asked who“won” 2014—the good guys, the bad guys, or no one in particular. At this point humanintervention was necessary, and we hand-sorted terms into categories of “good guys,” “badguys,” and “neutral” in order to perform categorical analysis as to whether attackers ordefenders were better represented over the course of the year.We found that security experts’ view of the world may in fact be a bit dimmer than that of thegeneral public. Though the public (as seen through our key words) was concerned about thingssuch as malware (#1 on their list), attacks (#3), and exploits (#5), by and large consumersseemed to use fairly neutral terms when diving into security-related topics online.The pros, on the other hand, are a skeptical lot. We classified nearly half of the most popular keyphrases as negative in tone. The value-neutral “operating system” led the pack, but after thatthe misery began with “targeted attacks” (#2), “exploit kit” (#3), “social engineering” (#5), and“C&C server” (#6) and continued from there. Interestingly, the key phrase “security researchers”nearly doubled in usage between 2013 and 2014, while the more familiar term key word“hackers” turned in steady usage numbers and barely outperformed the longer phrase.6