Symantec Website Security Threat Report 2014 - RapidSSLOnline
2 likes3,005 views
In 2013, targeted attacks increased, with spear-phishing attacks rising 91% over 2012. Watering hole attacks utilizing unpatched website vulnerabilities and zero-day exploits also grew. Eight data breaches exposed over 10 million identities each, termed "mega breaches". A total of 552 million identities were breached in 2013, over 5 times more than the 93 million in 2012. Web attacks blocked per day rose 23% from 2012. 78% of websites had vulnerabilities, and 16% had critical vulnerabilities that could be easily exploited by attackers.
Symantec Website Security Threat Report 2014 - RapidSSLOnline
- 1. Website Security Threat Report 2014 2013 Trends, Volume 19, Published June 2014 PART1 PART2 PART3 TIMELINE • KEY NUMBERS • TARGETED ATTACKS
- 2. 2 I Symantec Corporation Website Security Threat Report 2014 - Part 1 I Volume 19 Contents Introduction 3 Executive Summary 4 2013 Security Timeline 5 - 7 2013 in Numbers 8 Breaches 9 Web 10 Targeted Attacks 11 Spear-Phishing 12 Web based 13 - 14 Spear-Phishing (cont) 15 - 17 Looking ahead 18 Keep your business secure with Symantec 19 About Symantec 20
- 3. 3 I Symantec Corporation Introduction Symantec has the most comprehensive source of Internet threat data in the world through the Symantec™ Global Intelligence Network, which is made up of more than 41.5 million attack sensors and records thousands of events per second. This network monitors threat activity in over 157 countries and territories through a combination of Symantec products and services such as Symantec DeepSight™ Threat Management System, Symantec™ Managed Security Services, Norton™ products, Symantec Website Security Solutions and other 3rd party data sources. Symantec also maintains one of the world’s most comprehensive vulnerability databases, made of over 60,000 recorded vulnerabilities from over 19,000 vendors representing over 54,000 products. Spam, phishing, and malware data is captured through sources including the Symantec Probe Network, a system of more than 5 million decoy accounts, Symantec.cloud, Symantec Website Security Solutions Malware and Vulnerability products and a number of other Symantec security technologies. Skeptic™, the Symantec.cloud proprietary heuristic technology, is able to detect new and sophisticated targeted threats before they reach customers’ networks. Over 8.4 billion email messages are processed each month and more than 1.7 billion web requests filtered each day across 14 data centres. Symantec also gathers phishing information through an extensive anti-fraud community of enterprises, security vendors, and more than 50 million consumers. Symantec Website Security Solutions provides 100 percent availability and processes over 6 billion Online Certificate Status Protocol (OCSP) look-ups per day, which are used for obtaining the revocation status of X.509 digital certificates around the world. These resources give Symantec analysts unparalleled sources of data with which to identify, analyse, and provide informed commentary on emerging trends in attacks, malicious code activity, phishing, and spam. The result is the third Symantec Website Security Threat Report (based on Symantec’s ISTR Volume 19), which gives enterprises, small businesses, and consumers essential information to secure their systems effectively now and into the future. Website Security Threat Report 2014 - Part 1 I Volume 19
- 4. 4 I Symantec Corporation Executive Summary In 2013 attention was focused on cyber-espionage, threats to privacy and the acts of malicious insiders. However, the end of 2013 provided a painful reminder that cybercrime remains prevalent and that damaging threats from cybercriminals continue to cast a shadow over businesses and consumers. Eight breaches in 2013 each exposed more than 10 million identities and targeted attacks increased. This year’s WSTR covers the wide-ranging threat landscape, with data collected and analysed by Symantec’s security experts. In this summary, we highlight the key areas. The key trends in 2013 were: 2013 The Year of the Mega Breach The 2011 Internet Security Threat Report called out 2011 as the Year of the Data Breach. 2013 can best be described as the Year of the Mega Breach. The total number of breaches in 2013 was 62 percent greater than in 2012 with 253 total breaches. It was also larger than the 208 breaches in 2011. But even a 62 percent increase does not truly reflect the scale of the breaches in 2013. Eight of the breaches in 2013 exposed more than 10 million identities each. In 2012 only one breach exposed over 10 million identities. In 2011, only five were of that size. In total over 552 million identities were breached in 2013, putting consumer’s personal information (credit cards, passwords, address details etc…) at risk. Targeted Attacks Grow and Evolve As first reported in last year’s report, attackers added watering-hole attacks to their arsenal. The reports of the death of spear-phishing are greatly exaggerated. While the total number of emails used per campaign has decreased and the number of those targeted has also decreased, the number of spear-phishing campaigns themselves saw a dramatic 91 percent rise in 2013. Zero-day Vulnerabilities and Unpatched Websites Facilitated Watering-Hole Attacks More zero-day vulnerabilities were discovered in 2013 than any other year Symantec has tracked. The 23 zero-day vulnerabilities discovered represent a 61 percent increase over 2012 and are more than the two previous years combined. Zero-day vulnerabilities are so valued because they give attackers the means to infect their victim without resorting to social engineering. By applying these exploits to a watering-hole attack they avoid the possibility of anti-phishing technology stopping them. Unfortunately legitimate web sites with poor patch management practices have facilitated the adoption of watering-hole attacks. 78 percent of legitimate websites had exploitable vulnerabilities and 1-in-8 of all websites had a critical vulnerability. This gives attackers plenty of choices in websites to place their malware and entrap their victims. Generally speaking cutting-edge attackers stop using a vulnerability once it is made public. But this does not bring an end to their use. Common cybercriminals rapidly incorporate these vulnerabilities to threaten us all. Even though the top five zero-day vulnerabilities were patched on average within four days, Symantec detected a total of 174,651 attacks within 30 days of these top five becoming known. Prevalence of Scams Fail to Change User Behaviour on Social Media We all continue to fall for scams on social media sites. Fake offers such as free mobile phone minutes accounted for the largest number of attacks of Facebook users in 2013 – 81 percent in 2013 compared to 56 percent in 2012. And while twelve percent of social media users say someone has hacked into their social network account and pretended to be them, a quarter continue to shared their social media passwords with others and a third connect with people they don’t know. Attackers are turning to the Internet of Things Baby monitors, security cameras and routers, were famously hacked in 2013. Additionally, researchers demonstrated attacks against smart TVs, cars and medical equipment. This gives us a preview of the security challenge presented by the rapid adoption of the Internet of Things (IoT). Website Security Threat Report 2014 - Part 1 I Volume 19
- 5. Website Security Threat Report 2014 - Part 1 I Volume 19 2013 Security Timeline
- 6. 6 I Symantec Corporation 01January 02February 03March 04April 05May 06June Elderwood Project found using new Internet Explorer Zero-Day Vulnerability (CVE-2012-4792) Java Zero-Day found in Cool Exploit Kit (CVE-2013-0422) Android.Exprespam potentially infects thousands of devices Backdoor.Barkiofork used to target Aerospace and Defence industries Bamital botnet taken down Adobe zero-day used in “LadyBoyle” attack (CVE-2013-0634) Cross-platform toolkit for creating the remote access tool (RAT) “Frutas” discovered Fake Adobe Flash update discovered installing ransomware and performing click fraud Bit9 suffers security breach, code signing SSL certificates stolen Android Malware spams victims’ contacts “Facebook Black” scam spreads on Facebook Blackhole Exploit Kit takes advantage of financial crisis in Cyprus Several South Korean banks and local broadcasting organisations impacted by cyber-attack #OpIsrael hacktivism campaign targets Israeli websites NPR, Associated Press, and various Twitter accounts hacked by Syrian Electronic Army (SEA) Distributed Denial of Service attacks hit Reddit and European banks WordPress plugin vulnerability discovered, allowing PHP injection LivingSocial resets passwords for 50 million accounts after data breach A US Department of Labor website becomes victim of a watering-hole attack Cybercriminals steal more than $1 million from a Washington state hospital SEA hacks twitter accounts of The Onion, E! Online, The Financial Times, and Sky New Internet Explorer 8 Zero-Day Vulnerability used in watering-hole attack (CVE-2012-4792) #OpUSA hacktivism campaign launches against US websites Seven men were arrested in New York in connection with their role in international cyber-attacks which resulted in theft of $45 million across 26 different countries Microsoft and FBI disrupt Citadel botnets A surveillance scandal emerges in the United States, as a former Government security contractor releases classified documents Zero-day vulnerability found in most browsers across PC, Mac, mobile, and game consoles Anonymous launches #OpPetrol attack on international oil and gas companies 65 websites compromised to host malicious ads with ZeroAccess Trojan FakeAV discovered on Android Phones 2013 Security Timeline Website Security Threat Report 2014 - Part 1 I Volume 19
- 7. 7 I Symantec Corporation 2013 Security Timeline 07July 08August 09September 10October Ubisoft hacked: user account information stolen France caught up in PRISM scandal as data snooping allegations emerge New exploit kit targets flaws in Internet Explorer, Java, and Adobe Reader FBI-style ransomware discovered targeting OSX computers Android Master Key vulnerability used in the wild Viber and Thomson Reuters latest victims of SEA attacks Channel 4 blog, New York Post, SocialFlow, Washington Post, New York Times, impacted by SEA DNS hijack caused thousands of sites to redirect users to exploit kit Two new ransomware scams found: One that changes Windows login credentials on Chinese systems, another that takes advantage of the NSA PRISM controversy Fake ‘Instagram for PC’ leads to survey scam Attackers targeted banks’ wire payment switch to steal millions Francophoned social engineering ushers in a new era of targeted attacks Syrian Electronic Army compromises US Marine Corps’ website, Fox Twitter accounts, supposedly using Mac Trojan ATMs discovered that dispense cash to criminals Ransomware called “Cryptolocker” surfaces that encrypts victims’ files and demands payment to decrypt them Symantec lifts lid on professional hackers-for-hire group Hidden Lynx Belgian telecom compromised in alleged cyber espionage campaign Symantec Security Response sinkholes ZeroAccess botnet The Silk Road marketplace taken offline, resurfaces by end of month SEA attacks GlobalPost and Qatar websites, US Presidential staff emails Adobe confirms security breach, 150 million identities exposed Blackhole and Cool Exploit Kit author arrested WhatsApp, AVG, Avira defaced by hacker group KDMS New ransomware demands Bitcoins for decryption key 11November Second Android master key vulnerability discovered Microsoft zero-day vulnerability being used in targeted attacks and e-crime scams (CVE-2013-3906) SEA hacks VICE.com in retaliation for article that supposedly names members Anonymous claims to have hacked UK Parliament Wi-Fi during London protest Linux worm that targets “Internet of Things” discovered Target confirms data breach leading to the exposure of 110 million identities 12December Data of 20 million Chinese hotel guests leaked Cross-site scripting vulnerability found in wind turbine control application Imitation versions of Cryptolocker discovered, attempt to capitalize on original’s success 105 million South Korean accounts exposed in credit card security breach Website Security Threat Report 2014 - Part 1 I Volume 19
- 8. 2013 in Numbers Website Security Threat Report 2014 - Part 1 I Volume 19
- 9. Mega Breaches are data breach incidents that resulted in the personal details of at least 10 million identities being exposed in an individual incident. There were eight in 2013, compared with only one in 2012. Breaches Breaches With More Than 10 Million Identities Exposed Top-Ten Types of Information Breached +700% 01 Real Names 02 Birth Dates 03 Government ID Numbers (Social Security) 04 Home Address 05 Medical Records 06 Phone Numbers 07 Financial Information 08 Email Addresses 09 User Names & Passwords 10 Insurance In 2013 Hacking continued to be the primary cause of data breaches. Hacking can undermine institutional confidence in a company, exposing its attitude to security and the loss of personal data in a highly public way can result in damage to an organisation’s reputation. Hacking accounted for 34 percent of data breaches in 2013. In 2013, there were eight data breaches that netted hackers 10 million or more identities, the largest of which was a massive breach of 150 million identities. In contrast, 2012 saw only one breach larger than 10 million identities. Total Breaches Total Identities Exposed 1562012 2532013 552Million 2013 93Million 2012 +62% +493% 9 I Symantec Corporation Website Security Threat Report 2014 - Part 1 I Volume 19
- 10. Approximately 67 percent of websites used to distribute malware were identified as legitimate, compromised websites. Web New Unique Malicious Web Domains 2011 2012 2013 74,001 55,000 56,158 -24% Web Attacks Blocked Per Day 2011 2012 2013 464,100 190,000 568,700 +23% 10 I Symantec Corporation Website Security Threat Report 2014 - Part 1 I Volume 19
- 11. Targeted Attacks Website Security Threat Report 2014 - Part 1 I Volume 19
- 12. Targeted Attacks - Spear-Phishing Spear-Phishing Attacks by Business Size Risk of Being Targeted 31% 19% 50% 2012 Small Business (SMB) 1 to 250 Medium Business 251 to 2,500 Large Enterprises 2,501+ Employees TARGETED ATTACKS SPEAR PHISHING 1 IN 2.3 1 IN 5.230% 31% 39% 2013 Targeted attacks aimed at Small Businesses (1-250) accounted for 30 percent of targeted spear-phishing attacks. 1 in 5 small business organisations was targeted with at least one spear-phishing email in 2013. 39 percent of targeted spear-phishing attacks were sent to Large Enterprises comprising over 2,500+ employees. 1 in 2 of which were targeted with at least one such attack. The frontline in these attacks is moving along the supply chain and large enterprises may be targeted through web-based watering-hole attacks should email- based spear-phishing attacks fail to yield the desired results. 12 I Symantec Corporation Website Security Threat Report 2014 - Part 1 I Volume 19
- 13. Targeted Attacks - Web-based Attackers generally have to find and exploit a vulnerability in a legitimate website in order to gain control and plant their malicious payload within the site. Compromising a legitimate website may seem to be a challenge for many, but vulnerability scans of public websites carried out in 2013 by Symantec’s Website Vulnerability Assessment Services found that 78 percent of sites contained vulnerabilities. Of this, 16 percent were classified as critical vulnerabilities that could allow attackers to access sensitive data, alter the website’s content, or compromise visitors’ computers. This means that when an attacker looks for a site to compromise, one in eight sites makes it relatively easy to gain access. At a Glance • Targeted attacks have become more focused as attackers have streamlined their attack methods. • The global average number of spear-phishing attacks per day in 2013 was 83. • Zero-day vulnerabilities, often used in watering-hole attacks, reached their highest levels since Symantec began tracking them. • Hackers were once again responsible for more data breaches than any other source. However, accidental exposure, as well as theft or loss, grew significantly in 2013. • There were over 552 million identities exposed in data breaches during 2013. Scanned Websites With Vulnerabilities ... ... % of Which Were Critical WEB VULNERABILITIES WEB-BASED +25% pts 53% 2012 -8% pts 24% 2012 78% 2013 16% 2013 1 IN 8 sites had critical unpatched vulnerabilities 13 I Symantec Corporation Website Security Threat Report 2014 - Part 1 I Volume 19
- 14. Targeted Attacks - Web-based Malware was found on 1 in 566 websites scanned by Symantec’s Website malware scanning service. Zero-day vulnerabilities are frequently used in watering-hole web-based targeted attacks. 97 percent of attacks using exploits for vulnerabilities initially identified as zero-days were Java-based. The total cumulated time between a zero-day vulnerability being published and the required patch being published was 19 days for the top-five most-exploited zero day vulnerabilities. The average time between publication and patch was four days. Websites Found With Malware Zero-day Vulnerabilities 1IN 532 2012 1IN 566 2013 +64%142012 232013 NUMBER OF DAYS AFTER VULNERABILITY PUBLICATION NUMBEROFATTACKSDETECTEDTHOUSANDS 2 4 6 8 10 12 14 16 0 90 Oracle Java SE CVE-2013-1493 54% Oracle Java Runtime Environment CVE-2013-2423 27% Oracle Java Runtime Environment CVE-2013-0422 16% Microsoft Internet Explorer CVE-2013-1347 1% Microsoft Internet Explorer CVE-2013-3893 <1% Top-5 zero-day vulnerabilities 4 days Average time to patch 19 days Total cumulated of exposure for top 5 zero-days 23 software vulnerabilities were zero-day, 5 of which were for Java 97% of attacks using exploits for vulnerabilities identified as zero-day were Java-based However, the average number of attacks per campaign has dropped, down 76 percent when compared to 2012 and 62 percent from 2011. This indicates that while each attack campaign is smaller, there have been more of them in 2013. Changes in 2013 It’s worth looking back at the last few years to see how previous attack trends compare to the ones in 2013. • A 42 percent increase in the targeted-attack rate when compared to 2012 • In 2013 the attack rate appears to have dropped 28 percent, returning to similar levels seen in 2011. • Attacks appear to have become more focused as the attackers have solidified and streamlined their attack methods. • Looking at email-based attack campaigns,1 the number of distinct campaigns identified by Symantec is up by 91 percent from 2012, and almost six times higher compared to 2011 1 An attack campaign is defined as a series of emails that: A.) Show clear evidence that the subject and target has been deliberately selected. B.) Contain at least 3 or 4 strong correlations to other emails such as the topic, sender address, recipient domain, source IP address, etc. C.) Are sent on the same day or across multiple days. 14 I Symantec Corporation Website Security Threat Report 2014 - Part 1 I Volume 19
- 15. 15 I Symantec Corporation Spear-phishing attacks rely heavily on social engineering to improve their chances of success. The emails are tailored by the attackers to spark the interest of the individual being targeted, with the hope that they will open them. For example, an attacker may send someone working in the financial services a spear-phishing email that appears to cover some new financial rules. In one aggressive example of spear-phishing the attacker sent an email and then followed up with a phone call directly to the target. The attacker impersonating a senior employee, requested that the target open an attachment immediately. For example, in 2013, 1 in 54 Symantec.cloud customers were targeted with at least one spear-phishing email. The seriousness of attempted spear-phishing attacks is even clearer, using the same methodology, when comparing these numbers to the annual risk of an office fire. The odds of a building catching fire are, at worst, around one in 161. Spear-Phishing (cont) In 2013, 1 in 54 Symantec.cloud customers were targeted with at least one spear-phishing email. The seriousness of attempted spear-phishing attacks is even clearer, using the same methodology, when comparing these numbers to the annual risk of an office fire. The odds of a building catching fire are, at worst, around one in 161. Theft in the Middle of the Night On occasion, evidence of a cybercrime comes from an unexpected source. A financial services company noticed an unusual early morning money transfer on a particular day, and from a particular computer. The company checked CCTV footage and discovered that there was no one sitting at the computer at the time of the transaction. A back door Trojan was found during the examination of the computer. The threat was removed, but not before the attackers made off with more than €60,000. Website Security Threat Report 2014 - Part 1 I Volume 19
- 16. Spear-Phishing (cont) TARGETED ATTACK KEY STAGES Source: Symantec 01 INCURSION The attacker gains entry to the targeted organisation. This is often preceded by reconnaissance activities where the attacker is looking for a suitable social engineering tactic. 02 DISCOVERY Once the attacker has gained entry, they will seek to maintain that access as well as discover what data and other valuable resources they may wish to access. 03 CAPTURE Once the valuable data has been discovered and identified, the attacker will find a way to collect and gather that data before trying to exfiltrate it. 04 EXFILTRATION The attacker will find a mechanism to steal the data from the targeted organisation. This may be by uploading it to a remote server or website the attackers have access to. More covert methods may involve encryption and steganography, to further obfuscate the exfiltration process, such as hiding data inside DNS request packets. 16 I Symantec Corporation Website Security Threat Report 2014 - Part 1 I Volume 19
- 17. 17 I Symantec Corporation Spear-Phishing (cont) Executable type 2013 2012 .exe 31.3% 39% .scr 18.4% 2% .doc 7.9% 34% .pdf 5.3% 11% .class 4.7% <1% .jpg 3.8% <1% .dmp 2.7% 1% .dll 1.8% 1% .au3 1.7% <1% .xls 1.2% 5% The larger the company, the greater the risk of receiving a spear-phishing email. More than 50 percent of email attachments used in spear-phishing attacks contained executable files in 2013. Microsoft Word and PDF documents were both used regularly, making up 7.9 and 5.3 percent of attachments respectively. However, these percentages are both down from 2012. One in 2.3 organisations with 2500+ employees were targeted in at least one or more spear-phishing attacks, while 1 in 5 small or medium businesses were targeted this way. Java .class files also made up 4.7 percent of email attachments used in spear-phishing attacks. Analysis of Spear-Phishing emails used in targeted attacks Source: Symantec Website Security Threat Report 2014 - Part 1 I Volume 19
- 18. 18 I Symantec Corporation Privacy and Trust Many factors helped to shape the threat landscape in 2013, and some will have an enduring impact by altering our thinking about how we behave and conduct ourselves online. For some, the attitude regarding online privacy may be a factor of our age and perhaps to some extent how long we have been online; however, the general attitudes regarding online trust and privacy changed more during 2013 than in any other time. In one sense, anything published online may be there forever; our proudest moments may sit alongside our most embarrassing ‘mistakes’. It is when the personal information we casually share falls into “the wrong hands” that we are most concerned. So much of what we do is online and linked across many different environments, social media applications, and devices. What we do in one area is quickly shared with another. Widespread cloud adoption has essentially enabled rapid growth to occur on an enormous scale, and as a result of some of the headlines in 2013 some people are already asking questions: “Do we still trust the cloud?” “Who should we trust to look after our personal data?” In 2014 and beyond we can expect social networking organisations and other online service providers to seek to win back the hearts and minds of their users by making online privacy and data security core to their offerings. The adoption of encryption technology is expected to grow in 2014 and beyond, not only for securing data on personal devices but for online transactions including emails. The use of personal VPNs is also likely to increase as concerned users become wary about the traffic that may be exposed through their Wi-Fi hotspot, or simply to prevent their ISP from being able to track their activity. More up-to-date, faster encryption protocols will be in demand to secure these devices, so even if data is exposed or a device falls into the wrong hands, users can be assured that it cannot be exploited by the criminals. Targeted Attacks and Data Breaches The huge scale of breaches dominated the headlines during 2013, and has forced both businesses and home users to seriously consider how they secure their confidential information to keep it both private and secure. The sheer number of data breaches and even larger volume of identities being leaked was alarming, and the majority of these were caused by hacking. As the pressure mounts not to become the next victim, businesses are looking more towards trusted security vendors as a one-stop solution provider to take care of all their data protection needs. Not only will the focus be on safeguarding against an attack by hardening the perimeter, but also on minimising the potential impact of any breach should one occur. The wider adoption of encryption technology will be at the core of securing personal data, intellectual property, and company secrets. It has often been considered difficult to implement a robust and comprehensive encryption policy within an organisation, hence the growing demand for such technology to become a seamless part of the underlying infrastructure rather than an add-on only used by a few. As more personal information is stored in the cloud and accessible online, we routinely share more data with each other. Businesses and governments need to routinely handle massive quantities of personal information securely. Important questions are now being asked by the owners of this data, such as whether the caretakers are taking sufficient protective measures to safeguard it, irrespective of whether information is on their own computers and devices or in the cloud. Looking ahead Website Security Threat Report 2014 - Part 1 I Volume 19
- 19. 19 I Symantec Corporation Keep your business secure with Symantec Not all SSL is the same because not all Certificate Authorities are the same. Symantec supports the world’s largest and most critical certificate deployments. 97 of the world’s 100 largest financial institutions and 75 percent of the 500 biggest e-commerce sites in the US use SSL Certificates from Symantec. Our robust PKI infrastructure includes military grade data centres and disaster recovery sites for unsurpassed customer data protection, availability, and peace of mind. Beyond SSL Our website security solutions include: SSL Algorithms Symantec SSL certificates offer you the choice of three different encryption algorithms: RSA, DSA, and ECC. Elliptic Curve Cryptography (ECC) Algorithm ECC is an option that is included with all Symantec PremiumSSL certificates. ECC provides stronger security and increased performance: it uses shorter key lengths (for instance a 256 bit ECC key provides the same level of security as a 3,072 RSA key). True 128-Bit SSL Encryption Server-Gated Cryptography (SGC) certificates enable 128-minimum to 256-bit SSL encryption*, the most powerful SSLencryption commercially available today. Vulnerability Assessment to help you quickly identify and take action against the most exploitable weaknesses on your website. A daily Malware Scan that examines your website, notifying you of infected pages, as well as the code causing the problem. The Norton Secured Seal Viewed over 750 million times a day – the Norton Seal is the most recognised sign of trust on the internet. Identified by Symantec Website Security Threat Report 2014 - Part 1 I Volume 19
- 20. 20 I Symantec Corporation More information Symantec Worldwide: http://www.symantec.com/ ISTR and Symantec Intelligence Resources: http://www.symantec.com/threatreport/ Symantec Security Response: http://www.symantec.com/security_response/ Norton Threat Explorer: http://us.norton.com/security_response/threatexplorer/ Norton Cybercrime Index: http://us.norton.com/cybercrimeindex/ About Symantec Symantec Corporation (NASDAQ: SYMC) is an information protection expert that helps people, businesses and governments seeking the freedom to unlock the opportunities technology brings – anytime, anywhere. Founded in April 1982, Symantec, a Fortune 500 company, operating one of the largest global data-intelligence networks, has provided leading security, backup and availability solutions for where vital information is stored, accessed and shared. The company’s more than 20,000 employees reside in more than 50 countries. Ninety-nine percent of Fortune 500 companies are Symantec customers. In fiscal 2013, it recorded revenues of $6.9 billion. To learn more go to www.symantec.com or connect with Symantec at: go.symantec.com/socialmedia. Website Security Threat Report 2014 - Part 1 I Volume 19
- 21. For specific country offices and contact numbers, please visit our website. For product information in the UK, Call: 0800 032 2101 or +44 (0) 208 6000 740 Symantec UK Symantec (UK) Limited. 350 Brook Drive, Green Park, Reading, Berkshire, RG2 6UH, UK. www.symantec.co.uk/ssl Website Security Threat Report 2014 - Part 1 I Volume 19 Copyright © 2014 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, the Checkmark Circle Logo and the Norton Secured Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.