The need to evolve IT security strategies to match new and emerging threats has come clearly to the fore in the past year as attackers become increasingly adept at evading traditional security controls and stealing data without being detected.
Attackers have quickly adapted to new technologies, exploiting a range of security vulnerabilities in mobile, virtualised and cloud environments to target sensitive data, but social engineering mainly in the form of email phishing continues to be a key factor in most targeted attacks.
The need to defend against disruption has also increased in the past year with a growing number of disruptive cyber attacks by hackers with political agendas, with denial of service attacks becoming more powerful and more common.
The past year has seen a sharp shift in focus from traditional perimeter defences to more data-centric security controls, intelligence-based security systems and building a capability to detect, respond and mitigate the effects of data breaches once they occur.
There has also been an increasing emphasis on the need for information security professionals to be aligned with the business to enable new opportunities and information sharing in secure ways.
As a growing number of devices become internet enabled, security experts expect the so-called internet of things to present a whole new order of security challenges.
Read our top 10 IT security stories of 2013 here:
White hat hackers have shown that usernames, passwords, contact lists, details of e-commerce accounts and banking details can be sniffed easily from public Wi-Fi hotspots. To illustrate one of the many ways people can have their data compromised, the white hat hackers from First Base Technologies conducted two tests in partnership with security firm Trend Micro.
Digitally signed malware is a fast-growing threat that is aimed at bypassing whitelisting and sandboxing security controls, say security researchers. “We found 1.2 million pieces of new signed malware in the last quarter alone,” said David Marcus, director of advanced research and threat intelligence at McAfee. This is malware that is signed using legitimate digital certificates that have not been stolen or forged, but acquired from certificate authorities (CAs) or their sub-contractors, he said.
In July, the FBI issued a warning about an increase in spear-phishing attacks targeting multiple industry sectors. Spear phishing – a highly targeted phishing email – is one of the tools used by attackers to compromise endpoints and gain a foothold in the enterprise network. According to the FBI, victims are selected because of their involvement in an industry or organisation the attackers wish to compromise.
The Open Web Application Security Project (Owasp) continues to rank SQL injection attacks at the top of its 10 most critical web application risks. But what is an SQL injection (SQLi) attack, why are they important, and why have they remained unsolved more than 15 years since they first appeared – and has that changed?
RSA executive chairman Art Coviello ended his opening keynote speech at RSA Europe 2013 with a call to the IT security industry to show the same spirit as Europe in setting up a common market after the Second World War. But what exactly does he have in mind?
New security technologies are finally making it easier for security to enable the business and drive value, according to Dave Anderson, senior director at Voltage Security. Many of the largest organisations in the world are beginning to use information security as a strategic advantage and to re-establish the value of data. “Although we have been talking about this for years, it has become much easier to achieve in the past year to two years,” he told Computer Weekly.
Most firms are not as prepared as they should be for responding to cyber attacks, says e-discovery firm Guidance Software. But with sensible reviews of processes and communications strategies, up to 70% of firms could put themselves on a much better footing, said Nick Pollard, the firm’s senior director of professional services.
The number of distributed denial of service (DDoS) attacks monitored at over 20Gbps this year is more than three times greater than for the whole of 2012, according Arbor Networks. Despite the business risks of DDoS attacks, a survey by communications firm Neustar, published in July, found that 20% of UK respondents admitted that their companies have no DDoS protection in place.
The Syrian hacktivist attack on the New York Times website highlights urgent need for registry locking, says communications and analysis firm Neustar. The site was unavailable after the Syrian Electronic Army (SEA) that supports Syrian president Bashar al-Assad was able to access the domain name system (DNS) settings for the site. The SEA breached the NYT’s domain name registrar Melbourne IT and changed the DNS record to point to systems in Syria and Russia.
The internet of things will pose enormous security and privacy challenges, a CW500 Club meeting heard. By 2020, trillions of sensors will be feeding data across the internet, recording everything from people’s movements to what they have just bought. Such data may prove invaluable for city planning or alerting consumers to special offers on their favourite products in a nearby shop, but it also poses unprecedented risks to individuals' privacy and security, a meeting of senior IT leaders heard.