Hewlett Packard Enterprise has released its latest report (HPE Cyber Risk Report 2016) providing an interesting perspective on the threat landscape prevailing in 2015. The report is compiled by an analysis by the research team of data collected from open source intelligence.
The research highlights the following key themes.
- Collateral damage
- Overreaching regulations
- Need for Broad impact solutions
- Decoupling Privacy and Security efforts
- Persistence of earlier threats
- Attacks on Applications
- Monetization of Malware
The detailed report is available here.
The report highlighted that in several instances, attacks touched people who never dreamed they might be involved in security breach, causing collateral damage. Two cases cited as example for such collateral damage were the cases involving the United States Office of Personnel Management and Ashley Madison.
The report also highlighted that the reaction from the regulators to the attacks were often damaging and counter productive. It was observed that the over reaching regulations pushed legitimate security research underground.
The report indicated that the fixes to vulnerabilities should move from releasing patches to individual vulnerabilities to building sustainable defences to prevent attacks. It urges Adobe and Microsoft in particular to invest in broad asymmetric fixes that knock out many vulnerabilities at once.
An interesting observation held out in the report is that in the wake of revelations by Edward Snowden and other whistle blowers have led to moves to erode “Privacy” rights in preference to “Security” needs.
It was also observed that many of the incidents arose from bugs already known to the market indicating that there was negligence in implementing security patches of the earlier years.
Report indicates that attackers have shifted efforts to attack applications directly rather than attacking the perimeter network. It observes that with increasing use of Mobiles, the perimeter of a network is in the user’s pockets and the security practitioner needs to recognize this.
The report also highlights the growing malware market which has strengthened the attack industry and increased its disruptive capabilities.
Security professionals need to study the report in detail and factor the observations while building the security in their respective environments.
Naavi
