The volume of cyber attacks are expected to decline in 2015, but will become more sophisticated with such intrusions targeting specific sectors like healthcare, says the cyber security solutions firm Websense.
According to Websense’s cybersecurity predictions for 2015, as mobile apps are using auto-login capability these devices will face more attacks from cyber criminals for more credential-stealing or authentication attacks that can be used at a later date. ”The nature of cyber attacks is changing with criminals going for personally identifiable information (PII), which can be used at a later date. Such attacks are expected to escalate as we go ahead,” Websense Manager Sales Ajay Dubey told PTI. PII is an information that can be used to uniquely identify, contact or locate a single person.
Cybercriminals are using PII to get answers to security questions that are used to verify a user’s identity. Also they keep this information with them and use it at a later date or also try to use the victim’s profile to get personal information of their contacts, family or friends, he added. The report states that healthcare sector will see a rise in data stealing attack campaigns as the records hold a treasure trove of PII that can be used in a multitude of attacks and various types of fraud. ”In an environment still transitioning millions of patient records from paper to digital form, many organisations are playing catch-up when it comes to the security challenge of protecting personal data. As a result, cyber-attacks against this industry will increase.” it added.
The report further said with auto-login capability of mobile apps, mobile devices will increasingly be targeted for broader credential-stealing or authentication attacks to be used at a later date. These attacks will use the phone as an access point to the increasing Cloud-based enterprise applications and data resources that the devices can freely access, it added. Another serious development is that there will be new (or newly revealed) players on the global cyber espionage/cyber war battlefield, which will also include countries with higher projected economic growth, the report said.
Techniques and tactics of nation-state cyberespionage and cyberwarfare activities have primarily been successful. As a result, additional countries will look to develop their own cyber-espionage programmes, particularly in countries with a high rate of forecasted economic growth, it added. ”In addition, because the barrier of entry for cyber activities is minimal compared to traditional espionage and war costs, we believe we will see an increase in loosely affiliated cells that conduct cyber-terrorist or cyber warfare initiatives independent from, but in support of, nation-state causes,” the report said.
According to Websense’s predictions for 2015, credit card thieves will morph into information dealers and will begin to seek a broader range of data about victims. These fuller, richer, personal identity dossiers of individual users, consisting of multiple credit cards, regional and geographic data, personal information and behaviour, will be increasingly traded in the same manner that stolen credit cards are today, it added. The pace of software development demands that new applications are built on open source or legacy proprietary source code. As new features and integrations build on top of that base code, vulnerabilities continue to be overlooked, the report said.
Next year, attackers will successfully exploit seemingly divergent application software through vulnerabilities in the old source code that these applications share, it added. ”Though the web remains the largest channel for attacks against businesses, new highly-sophisticated email evasion techniques will be introduced and designed to circumvent the latest enterprise-grade defences,” it said. Traditionally used as a lure in past attack scenarios, email will become a more pervasive element of other stages of an attack, including the reconnaissance stage,” it added.
Besides, cyber criminals will increasingly use social and collaborative tools to host their command and control infrastructure. ”Those charged with protecting business from attack will have a difficult time discerning malicious traffic from legitimate traffic when communications to Twitter and Google Docs are not only allowed, but also encouraged,” the report added.