Targeted attacks on companies

Stop IT!

Amid the flood of daily intruder attacks, you will find sophisticated, targeted attacks on specific companies. Adapted to a company's systems and staff, these attacks promise cybercriminals great monetary success. This article looks at watering hole and spear phishing attacks and shows how to protect yourself and your users.

A Ponemon Institute study has revealed some interesting information about cybercriminal practices. Ponemon interviewed approximately 10,000 hackers regarding how they worked. Seventy nine percent of those surveyed described themselves as involved in the cyber attacker community. All told, 69 percent of those surveyed wanted to earn money with their attacks. The annual average salary is said to be EUR26,259 (~$28,199). Thus, the majority of attackers who responded earn far less than the security experts in the companies they attack. As a result, cybercriminals are highly motivated to achieve their goals with minimal effort, and they clearly prefer low-hanging fruit.

Large numbers of automated vulnerability scans help attackers determine the extent to which a company is vulnerable to known security holes. If cybercriminals cannot access the desired target quickly enough, 72 percent of respondents completely canceled the attack. According to the survey, robust security measures in the enterprise cause approximately 69 percent to cancel the attack. If the overhead is increased by 40 hours, 60 percent of the attackers give up. At least 36 percent of attackers give up after 20 hours, 25 percent after 10 hours, and 13 percent after 5 hours.

In the case of companies with a very good IT security infrastructure, planning and executing an average attack takes 147 hours. This is more than twice the time it takes for an average security level, assuming the attacker has a good to very good level of knowledge. However, many attacks still succeed despite increasingly complicated enterprise defenses. Ponemon also studied the methods deployed

... comments powered by Disqus