A newly released study by global information protection expert Symantec Corp. delves into the problem of cyber security and suggests that we've only seen the tip of the iceberg.

The increase in mega breaches, aggressive ransomware, mobile technology threats and hackers' discovery of the Internet of Things in 2013 all point to the continuing rapid growth of cyber crime.

The Internet Security Threat Report (ISTR) is an annual study based on findings from Symantec's global intelligence network of 41.5 million attack sensors, monitoring threat activity in more than 157 countries and territories. Over the past two decades, Symantec, probably best known for its Norton consumer security product, has identified more than 60,000 recorded vulnerabilities from more than 19,000 vendors.

The report states that 2013 was a watershed year for cyber security, with a lot of attention focused on cyber-espionage, privacy threats and the acts of malicious insiders. But with last December's big Target breach and other security hacks, the message was clear: cybercriminals who are simply in it for the money are still out there, and growing. And social media carelessness, the growth of mobile devices, and the burgeoning universe of the Internet of Things (smart cars, refrigerators, medical devices and more) is giving cyber criminals an even bigger playground.

Following are the top trends Symantec identified in the report:

1. 2013 was year of the mega breach. Total number of breaches was 62% greater than 2012, with 253 total breaches. Eight breaches each compromised more than 10 million identities. In comparison, in 2012, only one breach exposed more than 10 billion, and in 2011, only 5 were that size. More than 552 million identities were breached in 2013, putting credit card information, birth dates, government ID numbers, home addresses, medical records, phone numbers, financial information, email addresses, logins, passwords and other personal information into the criminal underground.

2. Targeted attacks grow and evolve. Far from being dead, phishing is on the rise: the number of spear-phishing campaigns increased 91% in 2013, with campaigns running longer. Industries most at risk were mining, governments and manufacturing, with odds of being attack 1 in 2.7, 1 in 3.1 and 1 in 3.2, respectively.

3. Zero-day vulnerabilities and unpatched websites facilitated "watering-hole" attacks. Symantec uncovered 23 zero-day vulnerabilities (software holes unknown to the vendor) in 2013, a 61% increase over 2012. And even though the top five of these were patched on average within four days, Symantec detected more than 174,000 attacks within 30 days of the vulnerabilities being known. Legitimate websites with poor patch management practices are vulnerable to watering-hole attacks—so called because hackers target these websites to place malware and entrap victims. The Symantec report found that 77% of legitimate websites had exploitable vulnerabilities and 1 in 8 of all websites had a critical vulnerability.

4. The rise of ransomware. Ransomware scams—where the attacker pretends to be law enforcement and demands a fake fine of between $100 and $500—first appeared in 2012 and rapidly escalated, growing by 500% over 2013. Criminals have now dispensed with the law-enforcement pretense and simply demand money. The most prominent of these scams is Cryptolocker, which encrypts user files and demands a ransom for unencryption. With the ubiquity of online payment methods, this method of extortion is expected to grow in 2014 and small businesses and consumers are at highest risk.

5, Mobile is the new market for social media scams and malware. The ongoing increase of mobile devices is opening up a new frontier for fraud. Symantec's Norton Report indicates that 38% of mobile users had experienced mobile cybercrime. And although lost or stolen devices are still the biggest risk, increased use of sensitive data on mobile devices is upping the ante: 52% of mobile users store sensitive files online, with 24% storing work and personal information in the same online storage accounts, and 21% share logins and passwords with families, putting both their personal data and their employers' data at risk. And only 50% of these users take even basic security precautions.

6. Social media behavior: dumb and dumber. Social media sites are awash with risk. Fake offers such as free cell phone minutes accounted for the largest number attacks on Facebook users in 2013: 81% in 2013 compared to 56% in 2012. And although 12% of social media users say someone has hacked into their social network account, a quarter of them still share passwords with others and connect with people they don't know.

7. Attackers are turning to the Internet of Things (IoT). With the Internet seeping into everyday devices, more opportunities are opening up for scammers. Baby monitors, security cameras and routers, smart televisions, cars and medical equipment were hacked in 2013. A bigger concern is attacks against consumer routers by computer worms like Linux.Darlloz. Controlling these devices can push victims to fake websites, usually to steal financial information.

The ISTR concluded with best practices recommendations for businesses, including:

Emphasize multiple, overlapping, and mutually supportive defensive systems, including regularly updated firewalls and gateway antivirus, intrusion detection or protective systems.
Regularly monitor for network incursion attempts, vulnerabilities and brand abuse.
Install the latest versions of endpoint antivirus software.
Be aggressive in updating and patching.
Ensure regular backups are available.
Ensure you have infection and incident response procedures in place.
Educate users on basic security protocols.

For a complete copy of the report, go to:

http://www.symantec.com/content/en/us/enterprise/other_resources/b-istr_main_report_v19_21291018.en-us.pdf

Special Reports /

7 Scary Findings from the 2014 Symantec Internet Security Threat Report

Related Stories

Recommended For You