There are a huge number of cyber security reports being produced all of the time, and it can be hard to keep up.
CBR looks at some of the biggest reports of September and rounds up the biggest findings.
1. Check Point: Unknown malware downloads soar
Check Point researchers found in the 2016 Security Report that there had been a ninefold increase in the amount of unknown malware targeting businesses in 2015.
Unknown malware downloads numbered over 970 downloads per hour compared to 106 the previous year.
Check Point there were nearly 12 million new malware variants discovered every month during the period.
The report also found that one in five employees will cause a company network breach through either mobile malware or malicious Wi-Fi.
Email was a very common threat vector, with 75 percent of cases using email. 39 percent of endpoint attacks bypassed the network firewalls and 85 percent of endpoint threats were discovered by routine operations after they had already entered the enterprise.
The researchers analysed the activity of more than 31,000 Check Point gateways worldwide.
2. CyberArk: The industry is making progress
The 10th annual CyberArk Global Advanced Threat Landscape Survey found that organisations believe they are making progress on cyber security.
82 percent of respondents said that they believed the industry was making progress against attacks, with 79 percent saying that their organisations had learned lessons from major attacks.
The proportion of respondents believing that the C-level leadership and board in their organisation provided sound leadership in cyber security had increased year-on-year, with 67 percent now believing this compared to 57 percent in 2015.
However, as usual, the reality was no match for the legend: while 55 percent of respondents believed that their organisation had evolved processes for privileged accounts, 40 percent and 28 percent respectively stored passwords in an Office document and on a shared server or USB stick.
3. ThreatMetrix: Attacks on online transactions grow
The ThreatMetrix Cybercrime Report Q2 has found that the number of attacks taking place in online transactions had increased markedly in a year, reaching 55 million attacks in the quarter.
This represented a 66 percent increase on the previous year.
ThreatMetrix also found that 10 percent of European account creations were being rejected due to concerns over data breaches.
4. Symantec: IoT devices are being increasingly used for DDoS attacks
The research found that hackers were increasingly taking control of poor security on Internet of Things (IoT) devices in order to hijack them for DDoS attacks.
Symantec found that 2015 was a record year for IoT attacks, with eight new IoT malware types being discovered. In 2013 there were two and in 2014 there were three.
In 2016, the number of new IoT malware families fell to two, although Symantec found that much of the malware from 2015 was still active.
The report found that weak passwords were responsible for much of the activity; the most common credential used by the malware to hack into the IoT devices was the combination of ‘root’ for the username and ‘admin’ for the password.
The report follows a possible real-world example of an IoT botnet in action: the security blog KrebsOnSecurity was hit by a 620 Gbps DDoS attack on 20 September which owner Brian Krebs suggested had come from an IoT botnet.
5. Trustwave and Osterman: One in five businesses are not doing regular security testing
This report, built on a survey of 126 security professionals, found just how little attention some businesses were paying to cyber security.
One in five businesses surveyed claimed that they hadn’t done any security testing whatsoever in the last six months.
However, the general laxness around security went further than this: less than one in four respondents believed that their organisation was ‘very proactive’ in security testing.
Just under 50 percent believed that they were ‘somewhat proactive’.
The report found that 5 percent of organisations conducted detailed reviews of security testing to assess vulnerabilities on a daily basis, while 24 percent did so weekly or several times a week. 25 percent of the organisations conducted the reviews over larger time frames, such as quarterly or annually.
Meanwhile, 20 percent only did so when they felt the need to.
6. Acunetix: More than half of websites have a severe vulnerability
Acunetix’s report, Web Application Vulnerability Report 2016, looked at 45,000 website and network scans on 5700 scan targets between April 2015 and March 2016.
It found that 55 percent of websites had one or more severe vulnerabilities, an increase of 9 percent from the figure in 2015.
Acunetix’s report found 84 percent of web applications with medium-level vulnerabilities, while 16 percent of perimeter were susceptible to at least one medium vulnerability.
The top three web application vulnerabilities were SQL injection, cross-site scripting and vulnerable JavaScript Libraries. The latter vulnerability had increased markedly, more than doubling year-on-year.
7. Promon: Most users wouldn’t know if their mobile device had been cyber attacked
App security specialist Promon found that 89 percent of mobile users would not know if their device had been infected.
41 percent believed that avoiding accessing private information over public wi-fi was enough to protect their devices.
Security apps were used by 27 percent of respondents, while 22 percent took no steps at all to protect their mobile devices.
43 percent relied on a password to protect their device.
There was also evidence that people didn’t view security as their responsibility, with 41 percent believing that banks are responsible for the security of their mobile apps while 64 percent of respondents believed that they were not responsible for their mobile banking app security.
