Organizations are finding it difficult to prioritize defense strategies against cyberattacks because most of them do not have an Internet-wide view of the attacks, according to a report from SANS Institute, the security training organization.
As a result, two security risks--Web applications and phishing--carry the greatest potential for damage, even though users instead tend to concentrate on less-critical risks.
The report, published by security training organization SANS Institute, amalgamates global data from security attacks on computers from March to August.
It identifies two main defense priorities for enterprise users. The first is targeted e-mail attacks, or spear phishing, that exploit client-side vulnerabilities in programs such as Adobe Systems' PDF Reader and Flash, Apple's QuickTime, and Microsoft's Office. These applications are described as the "primary initial infection vector used to compromise computers that have Internet access" and are the result of attackers taking advantage of "programming errors that are not being picked up by common vulnerability scanners."
The second priority is vulnerable sites. More than 60 percent of attacks are against Web applications and "convert trusted Web sites into malicious Web sites serving content that contains client-side exploits" by exploiting the most common vulnerabilities such as SQL injection and cross-site scripting flaws, in both open-source and custom-built applications. Such vulnerabilities make up more than 80 percent of attack opportunities.
A further finding is that applications are now more vulnerable and see more exploitation attacks than operating systems. There were no new major operating system worms seen in the wild during the reporting period.
Additionally, the report found there has been a "significant increase" over the past three years in the number of people discovering zero-day vulnerabilities: flaws that become known to attackers before they are discovered by security researchers, opening the chance of an attack against which no preparation has been made.
"This report is different from anything we have done before," a SANS spokesman said, "because it reflects massive amounts of data on the actual attacks (millions of them) and on the speed with which the underlying vulnerabilities are being patched (actual data from thousands of companies)."
The report sources includes attack data from 6,000 organizations, compiled by security hardware vendor TippingPoint, vulnerability data from 9 million computers compiled by security software vendor Qualys, and additional analysis and tutorial by the Internet Storm Center and SANS faculty members.
Manek Dubash of ZDNet UK reported from London.
The U.K. government plans to form a cybersecurity agency, with functions including cyberattack capability.
The Office of Cyber Security (OCS), dedicated to protecting Britain's IT infrastructure, will be created with a model proposed--and in part practiced by--the U.S. The U.K. government said Thursday that the OCS will have charge of a cross-government program, while a multi-agency Cyber Security Operations Centre (CSOC) will coordinate the protection of critical IT systems.
The OCS will also act as a conduit for information security collaboration between government and industry experts. Robert Hannigan, the prime minister's security adviser, said the OCS would be about "drawing together what people are already doing in the Ministry of Defense, the intelligence services, and the police."
The government has never admitted that it has the systems and personnel to launch a cyberattack. However, according to a senior government official, who wished not to be named, the OCS will have a role in coordinating cyberoffense capabilities that will build on the resources the government currently has.
In extreme cases, the government would launch a cyberattack in response to intrusions into the UK's own systems.
"Yes, we will do things proactively," the official said at a Cabinet Office press briefing. "Information assurance has been about building stronger walls, but there's only so much you can do. You come to a point when you are allowing criminals and others a low risk in continuing to attack, and there comes a time when that has to change. This is the first time we are saying publicly we are not going to sit back."
The government will develop information systems to allow it to launch denial-of-service attacks and to spy on chosen targets, said the official. "We will have a whole range of offensive capabilities, including distributed denial-of-service," said the official. "DDoS is not a first response. We definitely need graduated responses."
"Aggressive attacks are pretty far up the scale, and we want to avoid collateral damage as far as possible. It's a fine line. We don't want to get into cyberwarfare, but it's not reasonable to sit back," the official added.
The Cabinet Office official said the government would try to respond to attacks on U.K. systems by legal recourse: "Whenever we can, we will pursue criminals through legal frameworks, but that only works in some countries. Clearly, in other areas of the world, people are acting with impunity."
The model for the OCS is similar to that in the U.S., which plans to quadruple the number of security experts defending against cyberattack, while cyberoffense capabilities are currently under the aegis of the U.S. Air Force. The Pentagon will create a cybercommand to oversee U.S. cybermilitary efforts.
The OCS will pool intelligence capabilities from MI5, MI6, the Ministry of Defense, the Metropolitan Police e-Crime Unit, and the Serious and Organized Crime Agency.
The OCS will launch with a staff of 16 to 20, while the CSOC in will have 20 to 25. "We will start small and learn from initial U.S. attempts," said a Cabinet Office official.
Tom Espiner of ZDNet UK reported from London.
- prev
- 1
- next
