hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
hp-security-research-cyber-risk-report-pdf-2-w-1408
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
HP Security Research | Cyber Risk Report 2015maliciously created developer accounts. Ransomware was also a key theme throughout thispast year as attackers continued to exploit a business model where users’ data is held forransom by malware often using asymmetric encryption algorithms. Perhaps the most notableransomware is CryptoLocker, which appeared at the end of 2013 and caused significant damageprior to an FBI-led takedown. CryptoLocker has spawned a number of copycats, with CryptoWallthe most well-known.The threat from malware continues to rise as the attacks on Target and Home Depot highlightedthe <strong>risk</strong> from point-of-sale (POS) devices. By looking at the POS malware responsible forthese breaches, we have discovered that this type of malware is being actively developed bymultiple groups. Our investigation uncovered ongoing development, increasing sophistication,and a divergent code base in current POS malware. Significantly, these programs were built bypeople who knew the targeted environments. The attackers using them had gathered initialintelligence from the targeted systems before creating custom malware to exploit them. Thishighlights the planned nature of these attacks and reminds us that attackers are increasinglyplaying the long game. Enterprises must be able to monitor their networks and systems ina manner that allows them to discover malicious intelligence gathering and reconnaissanceactivities that may herald an approaching attack.There appears to be growing consumer awareness about privacy issues at the Internet ofThings (IoT) level, whether that’s concern that one’s television or thermostat represents a<strong>security</strong> and privacy <strong>risk</strong> or something else. The mass theft and online posting of privatephotos from hundreds of celebrities blurred the line between <strong>security</strong> and privacy, as what firstappeared to be an intrusion shaped up to be a bad combination of poor password choice andinadvertent saving of data to the cloud. IoT is much more than a buzzword—it’s a new paradigmthat brings ubiquitous computing and its <strong>security</strong> implications closer to the average person.Attacks could involve various layers of the device infrastructure. This could include applicationsrunning on smartphones or tablets, cloud services (including firmware and network servicestacks on Wi-Fi modules) as well as the firmware and application layers on the host processor.Various vectors of propagation could also be used, including compromising update files andexploiting network and host processor communication layer vulnerabilities, as well as possiblevulnerabilities in cloud service infrastructures and smart device applications.Jump in issues concerning the realm of<strong>security</strong> features from 2013 to 2014100%80%60%40%20%0%72%201386%2014In general, 2014 saw more Web applications containing vulnerabilities in each <strong>security</strong>kingdom than they did last year. Issues concerning the realm of Security Features—includingaccess control, privacy violation, password management, insecure transport, and <strong>security</strong> ofcryptographic primitives—jumped from 72 percent in 2013 to 86 percent in 2014. This statisticis consistent with the recent rash of privacy and confidentiality breaches, ranging from stolenpersonal data to credit card numbers to personal health information. The Security Featureskingdom also greatly affects mobile platforms, as the percentage of mobile applicationsthat contain <strong>security</strong> features issues (97 percent) is higher than that of Web applications(86 percent). Looking at data analysis of over 6,500 applications, increases in vulnerabilitydistribution by <strong>security</strong> kingdom grew in all but one category (and that category decreased byjust 1 percent).While the threat from the Internet itself can take on an increasingly global scale, a worldwidenetwork of <strong>security</strong> <strong>research</strong>ers stands ready to help the software industry secure its code. TheHP Zero Day Initiative is the world’s largest vendor-agnostic bug bounty program, with almost 10years’ experience coordinating vulnerability disclosure. Over its history, it has grown to a networkof over 3,000 independent <strong>research</strong>ers working to expose and remediate weaknesses in theworld’s most popular software. Over the past two years, <strong>research</strong>ers representing several newregions (including Germany, South Korea, China, and the Russian Federation) popped up withhigh submission rates and quality technical analysis. Researchers in these countries are not onlyfocusing on vulnerability discovery but also on innovative exploitation techniques.Looking ahead, technology continues to enhance our world in numerous ways, and with thatcomes the challenge of maintaining <strong>security</strong> and privacy throughout our digital lives. However,with increased cooperation and a thorough understanding of the imminent threats, we cancontinue to increase both physical and intellectual costs an attacker must spend to successfullyexploit a system.67