Kingdom of Bahrain

and some are starting to use built-in tools
and no executable malware at all to avoid
detection by endpoint protection code
that focuses on executable files. Recent
examples have offered to decrypt files
after the victim shared the ransomware
with two friends, and those friends paid to
decrypt their files. Ransomware authors
are also starting to use techniques other
than encryption, for example deleting or
corrupting file headers. And finally, with
“old” ransomware still floating around the
web, users may fall victim to attacks that
can’t be “cured” because payment locations
no longer work.
Emergence of personal IoT attacks.
Users of home IoT devices may not notice
or even care if their baby monitors are
hijacked to attack someone else’s website.
But once attackers “own” a device on a
home network, they can compromise
other devices, such as laptops containing
important personal data. We expect to see
more of this as well asmore attacks that
use cameras and microphonesto spy on
households. Cyber criminals always find a
way to profit.
Growth of malvertising and corruption
of online advertising ecosystems:
Malvertising, which spreads malware
through online ad networks and web pages,
has been around for years. But in 2016,
we saw much more of it. These attacks
highlight larger problems throughout the
advertising ecosystem, such as click fraud,
which generates paying clicks that don’t
correspond to real customer interest.
Malvertising has actually generated click
fraud, compromising users and stealing
from advertisers at the same time.
The downside of encryption. As encryption
becomes ubiquitous, it has become much
harder for security products to inspect
traffic, making it easier for criminals to
sneak through undetected. Unsurprisingly,
cybercriminals are using encryption in
creative new ways. Security products will
need to tightly integrate network and client
capabilities, to rapidly recognize security
events after code is decrypted on the
endpoint.
Rising focus on exploits against virtualized
and cloud systems. Attacks against
physical hardware (e.g. Rowhammer)
raise the possibility of dangerous new
exploits against virtualized cloud systems.
Attackers might abuse the host or other
guests running on a shared host, attack
privilege models, and conceivably access
others ‘data. And, as Docker and the entire
container (or ‘serverless’) eco-system
become more popular, attackers will
increasingly seek to discover and exploit
vulnerabilities in this relatively new trend in
computing. We expect active attempts to
operationalize such attacks.
Technical attacks against states and
societies. Technology-based attacks have
become increasingly political. Societies face
growing risks from both disinformation(e.g.,
“fake news”) and voting system
compromise. For instance, researchers have
demonstrated attacks that might allow a
local voter to fraudulently vote repeatedly
Users of home IoT
devices may not notice
or even care if their baby
monitors are hijacked
to attack someone
else’s website. But once
attackers “own” a device
on a home network, they
can compromise other
devices, such as laptops
containing important
personal data.
without detection. Even if states never
engage in attacks against their adversaries’
elections, the perception that these attacks
are possible is itself a powerful weapon.
What can organisations do to protect
against new threats?
Unfortunately, many organizations still
don’t have their security basics right. We
offer six measures organizations should put
in place to help keep more complex threats
at bay.
Moving from layered to integrated
security. Many organizations now possess
multiple solutions that were once bestin-breed
but are now too costly and
difficult to manage. Moving towards
integrated solutions where all components
communicate and work together will help to
solve this. For example, if malware knocks
an endpoint’s security software offline,
network security should automatically
quarantine that device, reducing the risk to
your entire environment.
Deploying next-generation endpoint
protection. As ransomware becomes
ubiquitous and endpoints grow more
diverse, organizations must refocus on
endpoint protection. But signature-based
solutions are no longer enough on their
own, and can miss zero-day attacks. Choose
solutions that recognize and prevent the
techniques and behaviors used in nearly all
exploits.
Prioritizing risk-based security. No
organization possesses the resources to
systematically protect everything, and
100% prevention is no longer realistic.
Clarify the risks associated with each
system, and focus your efforts accordingly.
Risks change fast: look for tools that track
them dynamically, and respond accordingly.
But make sure those tools are easy and
practical enough to use.
Automating the basics. You can’t afford to
waste time running the same reports and
performing the same security tasks you
always have. Automate wherever it can be
done simply and easily, so you can focus
scarce resources on serious risks and highvalue
tasks.
Building staff and process to deter and
mitigate social attacks. Since social attacks
now predominate, educating users and
involving them in prevention is now even
more important. Focus education on the
threats each group is likeliest to encounter.
Make sure it’s up-to-date: outdated
guidance on topics such as phishing can be
counterproductive, offering a false sense of
security.
Improving defender coordination.
Cybercrime is organized crime: defense
must be organized, too. That means
choosing tools and processes that eliminate
barriers within your organization, so
everyone can respond quickly to the same
attack. It may also mean looking for legal
and practical opportunities to collaborate
with other companies and the government,
so you can mitigate widespread attacks and
learn from others’ postmortems.
48 January 2017