Conférence CISCO ACSS 2018
- 1. Oran – 4 Avril 2018 Consultant Securite Afrique Cisco 2018 Annual Cybersecurity Report Tendances Chez les Attaquants et chez les Defendants Babacar Wagne
- 2. 2018 Annual Cybersecurity Report • Unprecedented levels of sophistication and impact • Becoming more adept at evasion • Exploiting new technology security gaps
- 3. 2018 Annual Cybersecurity Report • Visibilite – Traffic Encrypte
- 4. Malicious Binaries and Encryption Increase November 2016 Attackers embrace encryption to conceal their command-and-control activity 19% 12% Increase 268%70% 50% 38% Global Encrypted Web Traffic Malicious Sandbox Binaries with Encryption October 2017
- 5. 2018 Annual Cybersecurity Report • What files are being used in mails?
- 6. Malicious Documents in Email January-May June-October Compared usage of malicious attachments from first portion of 2017 to second Office 55% Archive 415% PDF 255%
- 7. 2018 Annual Cybersecurity Report • Techniques d’evasion dans les Sandboxes
- 8. Sandbox Evasion Patterns Attackers are constantly testing sandbox evasion techniques Document Close Doc Embedded in PDF Malicious Samples Total Samples Oct 2016 Volume Volume Oct 2017 Oct 2016 Oct 2017
- 9. 2018 Annual Cybersecurity Report • Nouveaux Types de Malware
- 10. Network-based Ransomware Network-Based Ransomware Worm WannaCry and Nyetya: rapid-moving, self-propagating network-based attacks With active, unpatched machines, these automated worms will attack again. Have you secured your network?
- 11. 2018 Annual Cybersecurity Report • Utilisation du Cloud
- 12. 53% manage over half of their infrastructure in the cloud Ease of use (46%) Scalability (48%) Lack of internal workforce (41%) Better security (57%) Appeal: The Cloud Organizations increase reliance on the cloud
- 13. Malicious Use of Legitimate Resources Adaptability Subverts Domain and Certificate Intelligence Easy Setup Whitelisted IP Address Cybercriminals are adopting command-and-control channels that rely on legitimate Internet services, making malware traffic almost impossible to shut down Reduce Burning Infrastructure Leverage Encryption for C2 Source: Anomali
- 14. 2018 Annual Cybersecurity Report • DDoS
- 15. IoT and DDos Application-layer attacks are rising, network-layer attacks are declining Burst attacks are increasing Amplification attacks • Complexity • Frequency • Duration 2/5of businesses experienced a reflection amplification attack in 2017 of those organizations mitigated the attacks2/3 Source: Radware
- 16. 2018 Annual Cybersecurity Report • Utilisation des Domaines
- 17. How Malicious Actors Leverage Domains 60%Spam 20%Malvertising 20%Other Organizations need to minimize access to malicious domains Type of Attack RLD Registered Times New or Reused Domains 80% More than 1 week 20% Less than 1 week 42% New 58% Reused
- 18. 2018 Annual Cybersecurity Report • Menace Interne
- 19. Insider Threat Machine learning algorithms can greatly help detect internal malicious actors 62% occur outside of normal work hours 5200 docs per user / 1.5 months PDFs were the most common file type “Data” was the most popular keyword in doc titles High* accuracy of malicious activity detection since June 2017
- 20. 2018 Annual Cybersecurity Report • IOT
- 21. IT/OT Attack Sentiment 69% of organizations believe OT is a viable attack vector in 2018 • 20% believe it will be eventually • 10% believe it will remain in IT alone
- 22. ICS Vulnerabilities Being Connected to the Internet Known Vulnerabilities Rarely Patched Lack of Knowledge Too Specialized USB or DVD as Entry Point Threat actors are actively engaged in researching pivot points to facilitate future attacks Source: TrapX
- 23. 2018 Annual Cybersecurity Report • Vulnerability Management
- 24. We need a better way to improve patch management processes High Severity Vulnerabilities and Patch Management High severity is driven by headlines MS17-010 Detections Patches double as organizations realize potential threat Exploited vulnerability makes headlines Microsoft warns of vulnerability NumberofDetections Month Source: Qualys
- 25. 2018 Annual Cybersecurity Report • Gestion des alertes par les Defendants
- 26. Alerts 44%of Alerts are NOT Investigated 8% Experienced NO Security Alert 56% of Alerts are Investigated 34% of Investigated Alerts are Legitimate 51% of Legitimate Alerts are Remediated 93% Experienced Security Alert Uninvestigated alerts still create huge business risk 49%of Legitimate Alerts are NOT Remediated
- 27. 2018 Annual Cybersecurity Report • Orchestration
- 28. Orchestration Challenges 8% 10% 21% 43% 55% 1-5 6-10 11-20 21-50 50+ Very Challenging 17% 24% 16% 42% 14% 25% 19% 14% 12% 27% Education Financial Services Government Healthcare Manufacturing Pharma Retail Telecom Transportation Utility/ Energy As the number of vendors increases, orchestration challenges grow
- 29. 2018 Annual Cybersecurity Report • Defenders Still use Best of Breed Approach
- 30. Defenders Still Favor Best of Breed 72%use best-of- breed 28%use single vendor solution vs.
- 31. 2018 Annual Cybersecurity Report • Defenders Approach
- 32. Strategic, Operational, and Tactical Issues 26% can be addressed by products alone 74% might also require people and/or processes to address People Products Policies An overemphasis on product solutions can leave openings for attackers
- 33. The Need for Outsourcing In order to keep up, organizations are looking for outside help 54% Consulting (up 3%) 49% Monitoring (up 5%) 47% Incident Response (up 2%) Most Frequently Outsourced Services
- 34. Market Expectations: Threat Landscape The threat landscape to remain complex and challenging • Few predict radically new threats on the horizon, but they see more capable and more diabolical bad actors • Believe they’ll need ever more sophisticated security arsenals to keep they at bay
- 35. Market Expectations: Modern Workplace The modern workplace will continue to create conditions that favor the attackers • The footprint security executives must secure continues to expand • Employees increasingly carry their work (and the company’s data) with them wherever they go—a well- documented source of exposure • Clients, partners and suppliers all need secure access to corporate resources • With the increasing deployment of IoT sensors, etc., companies’ interfaces to the internet will multiply dramatically
- 36. Market Expectations: Scrutiny Additional scrutiny of their ability to secure the organization • Many expect they’ll be under additional scrutiny—from regulators, executives, stakeholders, partners and clients • Top scrutiny from Executive Leadership, Clients, and Business Partners (76%, each) • Several CISOs mention that the need to meet others’ expectations for accessibility puts increasing strains on staff • Current and potential clients can be particularly demanding of information regarding security processes and protocols
- 37. Market Expectations: Breaches Drive Budget Budgets will remain stable, unless a security breach drives unexpected investment • 51%: Budgets based on previous year’s budget • 51%: Organization’s security outcome objective • 46%: Percent of revenue • 47%: Breach drove improvements to a great extent !
- 38. Market Expectations: AI and Machine Learning More spending on AI/ML capabilities • AI, ML and automation are all increasingly desired and expected • 83%: Reliant on automation to reduce the level of effort to secure the organization • 74%: Reliant on AI to reduce the level of effort to secure the organization • CISOs expect to take increasing advantage of AI and robotics
- 39. Market Expectations: Outsourcing More reliance on outsourcing services • 53%: More cost efficient • 52%: Desire for more unbiased insight • 51%: More timely response to incidents
- 40. Observed Threats and TTD Cloud-based security technology has been a key factor in helping Cisco maintain a low median despite an increase in threat samples Cisco Annual Median TTD (Hours) 37.1 14 4.6 2015 2016 2017 Number of Observed Threat Samples 10x Increase 2016 2017
- 41. Adversary tactics are continuously evolving, using encryption and legitimate Internet services to conceal their activity and undermine traditional security technologies Lead from the top: executives/board set the security tone, culture Top 7 Actions: . Educate by roles for maximum benefit . Adhere to corporate policies, practices for application, system, and appliance patching . Assume ownership of IoT device security and add scanning for these devices to security reviews . Review, practice security response procedures . Back up data often, test restoration procedures . Review third-party efficacy testing of security technologies to reduce risk of supply chain attacks . Conduct security scanning of micro-service, cloud service, and application administration systems Conclusion/Recommendations
- 42. Download the Cisco 2018 Annual Cybersecurity Report cisco.com/go/acr2018