internet security tHreAt rePOrt GOVernMent 2013

p. 112
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
MALICIOUS CODE TRENDS
While 55 percent of the mailboxes targeted for attack are
high-level executives, senior managers and people in R&D, the
majority of targets are people that are unlikely to have such
information. Why then are they targeted?
As we’ve said, they provide a stepping stone to the ultimate
target. And in the case of personal assistants, sales and media
(public relations), they work closely with people who are the
ultimate target. But just as important, these people are also easy
to find and research online: email addresses for public relations
people, shared mailboxes, and recruiters are commonly found on
a company’s website.
Additionally, these people are used to being contacted by people
they do not know. And in many cases part of the job requires
them to open unsolicited files from strangers. Think of how
many resumes a recruiter receives each day in a document or
PDF file attachment. Finally, under the illusion that targeted
attacks are only aimed at high-level executives or those working
with the company’s intellectual property (IP), they are less
likely to have their guard up against social engineering.
In Figure B.16, we can see that malicious EXEs are largely
used in targeted attacks (over one-third of attacks). However,
malicious DOCs and PDFs are commonly used by attackers
(44.4 percent of the attacks).
Looking at the break out of targeted attacks by industry,
Manufacturing was the most-targeted sector in 2012, with 24.3
percent of targeted attacks destined for this sector, compared
with 15 percent in 2011. Attacks against government and public
sector organizations fell from 25 percent in 2011, when it was
the most targeted sector, to 12 percent in 2012. It’s likely the
frontline attacks are moving down the supply chain, particularly
for small to SMBs.
Conclusion
Figure B.13. Breakdown of Document Types Being Attached to Targeted Attacks, 2012
Source: Symantec.cloud
45%
40
35
30
25
20
15
10
5
39%
EXE
34%
DOC
11%
PDF
5%
XLS
SCR
BIN
LNK
Targeted attacks should be concern for all organization, large
and small. While C-level executives and those that work with
a company’s IP should be careful, everyone in an organization
is at risk of being targeted. This is especially true of workers
who in the course of their jobs typically receive email from
people they don’t know. In the end, no matter the size or type
of organization you have or your role in that organization, you
are at risk and best practices must be followed to protect the
organization. Don’t become the weakest link in the supply chain.
2% 2% 2% 2% 1% 1%
CHM
DMP
DLL