The Briefing on Cybersecurity
The latest news, trends and data from the cybersecurity industry
In Data:
Cybersecurity News in Numbers
$3.9bn
The amount spent on cybersecurity by the air transport industry in 2018, according to the 2018 Air Transport Cybersecurity Insights report by SITA. The report also found that 89% of airline CIOs were planning a major cybersecurity plan in the next three years, up from 71% in 2017.
500 million
The number of people thought to have been impacted by the Marriott hack, which saw hackers access subsidiary Starwood over four years. During this time, the cybercriminals had access to a host of customer data, including passport and payment information. While card details were encrypted, it is possible that the hackers also had access to the encryption keys.
72%
The percentage of people who see fraudulent emails as the biggest cause of data breaches, according to research by Instant Offices. 33% also saw viruses, spyware and malware as a key threat, while 27% saw people impersonating the business in e-mails or online as a risk.
80%
The percentage of e-commerce businesses running leading platform Magento at risk due to failing to install critical security patches. According to Foregenix, 1.5% of businesses using the platform globally were also infected with malware. Of these, over half were infected with malware designed to steal payment details.
********
Six out of ten
The percentage of companies (59%) that have suffered a data breach due to third-party organisations, according to research by The Ponemon Institute. The research, which involved surveying over 1,000 CISOs, also found that in the US this number was higher, at 61%, representing a 5% increase on the previous year and a 12% increase from 2012.
Campaign Alert:
Emerging attack campaigns
Gift Card Scam
The latest example of spear phishing campaigns, this gift card scam was unearthed by Barracuda. The scam sees office managers, executive assistants and receptionists targeted and conned into sending gift cards to the attackers, under the belief they are an employee reward. This attack is on the rise as the holiday season progresses.
TEMP.Periscope
A Chinese threat actor identified by Recorded Future's Insikt Group, TEMP.Periscope uses Russian advanced persistent threat technqiues to perform spear phishing campaigns. In a recent campaign, the group targeted a UK engineering company, and has also targeted the Cambodian government by posing as a journalist.
SamSam returns
File-locking ransomware attack SamSam has seen another surge in the US, with a host of organisations being locked out of their own files and forced to pay a ransom to regain access. The attack, which is enacted through weak points in a company's security, is notable for its high ransoms, which often top $50,000.
Sextortion scam
Identified by Barracuda, the Sextortion scam is a ransomware campaign that takes advantage of data acquired in previous breaches. The attackers use stolen passwords to trick victims into paying Bitcoin to prevent the release of a compromising video to their contacts, which the attacker claims to have recorded on their computer.
New products alert:
Key launches this quarter
CylancePROTECT
AI-powered cybersecurity provider Cylance has launched a new cloud-based product for Amazon Web Services (AWS). CylancePROTECT uses AI to detect and prevent malware from executing, protecting application instances running on cloud services infrastructure.
SIEMless Threat Management
A new launch from security-as-a-service provider Alert Logic, SIEMless Threat Management provides a 24/7 threat management platform. Designed to be scalable, it is tailored to each business to provide a more affordable option than established services.
ImmuniWeb Discovery AI
Designed to determine how hackable websites and web applications are, High-Tech Bridge has launched the ImmuniWeb Discovery AI platform. It uses AI and big data to to map risks from emerging threats and cybercriminals, enabling companies to take action.
Managed Security Services
NTT Security has upgraded its Managed Security Services (MSS) platform with the inclusion of botnet infrastructure detection. Through this service, NTT can detect and proactively defend against botnet attacks on infrastructure, an ever-growing attack area.
Share
Share this article
