Story image

2019’s top three cybersecurity trends - Akamai

07 Jan 2019

Article by Akamai APJ security technology and strategy head Fernando Serto

February 2018 marked a historical event for the internet, the cybersecurity environment, and the evolution of cyber-attacks – a 1.3 Tbps Distributed Denial of Service (DDoS) attack.

The incident, exploiting memcached servers to reflect and amplify attacks, set a record for the largest publicly disclosed DDoS attack in history.

A few days prior to the attack, security organisations began to notice, research, and alert customers on this new DDoS attack method and how it can be exploited to generate much larger attacks. In 2018, organisations of every size need to rethink their security strategies – not only when it comes to external users accessing internal applications, but also how staff interact with applications on a daily basis.

This trend indicates that a zero-trust security model is here to stay.

Throughout the year, there were also a number of cybersecurity trends playing out.

Extortion of cryptocurrencies continuously made headlines, while towards the end of the year saw a rise of bot armies carrying out credential stuffing attacks.

In the evolving security landscape, businesses need to reflect on the incidents from the past year and understand how these will continue to grow and become more complex in their execution.

Therefore, it’s important to outline a number of trends from 2018 and how they will continue to develop in 2019.

The rise of sophisticated ‘low and slow’ credential stuffing attacks

The greatest weakness of any website is the password.

Everyday users, who are challenged with the task of juggling multiple accounts and credentials, tend to re-use the same passwords across different websites.

Following a data breach, malicious actors will obtain large databases of login credentials and employ botnets to rapidly insert these into websites to compromise accounts.

Fortunately, rapid login attempts are usually easily detected and mitigation with velocity-based detection systems.

While this is the traditional approach to credential stuffing, in September 2018 a trend of ‘low and slow’ attacks were identified that fly under the radar of velocity-based systems.

In 2019, Akamai expects the rate of slower attacks to increase, as malicious actors are more successful and remain undetected through this approach.

Cryptocurrency extortion

Following the internet’s largest DDoS attack, in March 2018 investigators found a ransomware note in the attack packets themselves that instructed the victim to transfer cryptocurrency to a Monero wallet address.

This incident of cryptocurrency extortion was added to the long list of extortion attempts in 2018.

In addition, we also saw a sharp rise in cryptojacking attempts through adware-based cryptominning software.

Next year, malicious actors are expected to move away from long-term cryptominers installed on compromised systems and converting to more of a gig-based attack economy.

The gig adversary

Over the past few years, cybercriminals have been moving towards a ‘gig’ economy – an underground community of malicious actors exchanging services.

This ‘cybercriminal gig economy’ is driving specialisation, and marketisation, across different attack verticals.

In the past, adversarial groups were responsible for developing and executing cyber-attacks.

For example, in credential stuffing attacks, previously malicious actors would work on building their own botnets to access and compromise accounts.

Whereas now, with the ‘cybercriminal gig economy’, one adversarial group would build a botnet to determine which accounts they can access with stolen credentials, then sell this information to another group to access and commit fraudulent activities on those accounts.

What this means for businesses is that cyber-attacks are becoming more sophisticated, accessible and purchasable.

We should expect to see further specialisation and monetisation of attacks as the economy grows.

As businesses begin to prepare for 2019, it’s important to observe ongoing patterns in cyber-attacks, as these will continue to evolve and advance.

Akamai also expects to see sophisticated phishing attacks, which target users who have network connectivity to servers in the environment, to exploit vulnerable software within the organisation.

Salesforce continues to stumble after critical outage
“To all of our Salesforce customers, please be aware that we are experiencing a major issue with our service and apologise for the impact it is having on you."
D-Link hooks up with Alexa and Assistant with new smart camera
The new camera is designed for outdoor use within a wireless smart home network.
Slack users urged to update to prevent security vulnerability
Businesses that use popular messaging platform Slack are being urged to update their Slack for Windows to version 3.4.0 immediately.
Secureworks Magic Quadrant Leader for Security Services
This is the 11th time Secureworks has been positioned as a Leader in the Gartner Magic Quadrant for Managed Security Services, Worldwide.
Google puts Huawei on the Android naughty list
Google has apparently suspended Huawei’s licence to use the full Android platform, according to media reports.
Using data science to improve threat prevention
With a large amount of good quality data and strong algorithms, companies can develop highly effective protective measures.
General staff don’t get tech jargon - expert says time to ditch it
There's a serious gap between IT pros and general staff, and this expert says it's on the people in IT to bridge it.
ZombieLoad: Another batch of flaws affect Intel chips
“This flaw can be weaponised in highly targeted attacks that would normally require system-wide privileges or a complete subversion of the operating system."