hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015SummaryIn a world where more and more people and devices connect to the Internet, greater focusmust be placed on security and privacy. The past year has seen the manifestation of severalvulnerabilities that gathered a storm of media attention. Network defenders should use theinformation in this report to better understand the threat landscape, and best deploy resourcesto minimize security risk. While the Internet has brought global connectivity to millions, thedarker side of the Internet is pervasive and influential. Our report shows the machinationsand maneuvers of criminals and state-sponsored operators in the cyber underground havesignificant and lasting effects on the security of the greater Internet and our greater societies.Cyber crime comes in many flavors, but it remains vastly driven by financial interests. Lookinginto nation-state-sponsored cyber activity highlights the many levels at which cyber operationsand state-sanctioned activity can occur, and demonstrates how malware and the tools andtechniques of cyber criminals can be utilized in different ways to accomplish different goals—such as stifling protest or targeting opposing state interests, as well as perpetrating fraud orstealing intellectual property.Of most concern to enterprises, intellectual property continues to be targeted by Chineseinterests in particular. Responses to this long-recognized threat and international cooperationto address these attacks are improving and continue to gain momentum. Other nationsalso pose significant threats in our globally connected world. Iran continues to develop itscyber capabilities and views hacker groups as a force multiplier to be used to target Westernentities, particularly corporations and government entities. North Korea has continued itstradition of asymmetric warfare in the age of the Internet, with a remarkable commitment todeveloping cyber warfare capabilities even as it copes with aging infrastructure. The Turkishhacker underground also continues to flourish. As far as financially motivated attacks go,while systems such as “chip and pin” are likely to prove useful, as particular points in financialprocesses get hardened, other points become more attractive to attackers, and as technologydevelops to improve the security of systems, it also conversely develops to make particulartargets increasingly accessible. We expect escalations in this area to continue.In the face of increasing threats, software vendors continue to make it more difficult forattackers with the implementation of security mitigations. However, these mitigations arenot enough when they are built on inherently vulnerable legacy code. On multiple occasionsin 2014, high-profile vulnerabilities were discovered that left enterprises scrambling todeploy patches and clean up compromised machines. Watching the industry respond to theHeartbleed vulnerability highlighted how unprepared we were for this type of disclosure. Dueto the severity and active exploitation of the vulnerability, corporations were forced to respondquickly, and to patch servers that were not routinely patched. The issue existed in an applicationlibrary that did not have a clear update path; enterprises did not have a solid understanding ofwhich applications were using this library and where it was located inside of their networks,further complicating efforts.Discovery of information disclosure vulnerabilities such as Heartbleed shows why informationdisclosure vulnerabilities are highly valued by the exploitation community. These issues canalso be used in conjunction with remote code execution vulnerabilities to bypass modernexploit mitigations. Heartbleed was a nice demonstration of a highly controllable informationdisclosure vulnerability due to a buffer over-read. Vulnerabilities found in legacy code werealso a significant factor in 2014, with flaws in Adobe Flash Player and RTF parsing in MicrosoftOffice being prime examples. In each case, either legacy or deprecated code was at fault. As thequality of exploits continue to improve, they reveal a deep understanding of the nature of thevulnerability and the internals of the target applications.The year 2014 saw the growth of malware continue to increase, with the number of newlycreated malware samples doubling year over year. It was also a significant year for mobilemalware, as 2014 was the year when mobile malware finally stopped being seen as justa novelty. While the majority of Android malware discovered in 2014 was found outsideof the Google Play market, there have been instances when malware was placed there by66