Security: Defenders Must Reduce the Time for Attackers to Operate

Today, attackers enjoy unlimited time to operate. Their campaigns, which often exploit known vulnerabilities that organizations and end users may have-and should know about and address-can remain active and unnoticed for days, months or even longer.

Defenders, meanwhile, are striving to gain visibility into activity around threats and to reduce time to detection (TTD) for new and known threats. They are making great and clear progress, but still have a long way to go to truly weaken adversaries’ ability to lay the groundwork for attacks to counter them with high, cost-effective impact.

The bi-annual Cybersecurity Report 2022 Cybersecurity Report 2022 which presents research, insights and perspectives from security professionals on the trends covered in our security report while also examining developments that could affect the security landscape later this year. Our observation of recent developments within and from the informal economy confirms that adversaries have only become more focused on revenue generation. Ransomware has become a particularly effective profitable business, and business users appear to be the preferred target for some operators.

Many of the threat and security trends presented in this report relate to ransomware, from techniques used to launch campaigns and hide attacker activity to our expectations for how the next generation of this potent threat will evolve.

In this report, we look at the many ways organizations can and should take steps to begin improving their defenses.

The researchers’ recommendations are as follows:

– Institute and test an incident response plan that enables a rapid return to normal business operations following a ransomware attack.
– Not relying blindly on HTTPS connections and SSL certificates
– Move quickly to fix published vulnerabilities in software and systems, including routers and switches that are components of the critical Internet infrastructure
– Educating users about the threat of malicious browser infections
– Understanding what actionable threat intelligence really is

In this report, we cover four main topics:

I. Top Story on Cybercrime Trends: Ransomware

Security researchers have turned their sights on ransomware by examining innovations that may make this specific type of malware attack much more prevalent. We also provide predictions on the evolution of ransomware, based on past trends observed. In addition, we analyze how vulnerabilities in unpatched systems and outdated devices give criminals time to operate. Ransomware operators are now targeting business users. This is why organizations must ensure that they back up critical data to a protected location and establish actionable plans that allow them to resume normal business operations as quickly as possible after an attack.

II. Time to operate

This section examines client-side attack vectors that provide adversaries with time and opportunity to innovate threats and conduct their campaigns. The increase in vulnerabilities related to encryption and authorization indicates that threat actors are now attempting to manipulate secure connections. Trends in attack kits and vectors are discussed, such as the attractiveness of server attacks for online criminals seeking access to larger data sets. The emergence of “malvertising-as-a-service” and the complications it creates for defenders is also discussed, as are the questions that arise about who should protect web users.

III. Time to secure

In this section, security researchers explore the gap between attacker activity and security solutions. For example, while vendors have shortened the time between the announcement of public vulnerabilities and the availability of patches, users have lagged in implementing such patches. This section also includes an update on Cisco’s ongoing efforts to reduce mean time to detection (TTD) and the impact of the ongoing “arms race” between attackers and defenders. Cisco researchers also detail the increasing use of HTTPS in malicious campaigns and the use of the Transport Layer Security (TLS) protocol by criminals to encrypt communications.

IV. Global Perspective and Security Recommendations

This section examines current geopolitical trends related to security, including growing government concerns about the challenges of keeping pace with technological change to understand threats and control or access data. Recommendations are also offered for defenders to reduce the time to operate for adversaries. In addition, the key difference between indicators of compromise (IOCs) and threat intelligence is explained.

Key findings

– Ransomware is dominating the malware market. While not a new threat, it has evolved to become the most profitable type of malware in history, and enterprises are now becoming the target of choice for some ransomware operators. In the first half of 2016, ransomware campaigns targeting individuals and business users became more widespread and effective. On the horizon: faster and more efficient propagation methods that maximize the impact of ransomware campaigns and an increased likelihood of generating significant revenue from adversaries.

– Attack kits, which have helped ransomware become such a notable threat, continue to exploit Adobe Flash vulnerabilities. In Cisco researchers’ recent analysis of the popular Nuclear attack kit, for example, Flash accounted for 80% of successful attack attempts.

– Vulnerabilities in JBoss enterprise application software provide attackers with a new vector they can use to launch campaigns such as ransomware. Cisco research shows that JBoss-related risks made significant inroads inside servers, leaving them vulnerable to attack.

– From September 2021 to March 2022, security researchers observed a five-fold increase in HTTPS traffic related to malicious activity. The increase in this type of web traffic can largely be attributed to malicious ad injectors and adware. Threat actors are increasing their use of encrypted HTTPS traffic to hide their web activity and extend their time to operate.

– While patches are available from major software vendors at about the same time vulnerabilities are announced, many users are still failing to download and install them in a timely manner, according to Cisco research. The gap between the availability and actual deployment of such patches gives attackers ample time to launch attacks.

– To direct attention to the security risks organizations create by failing to properly maintain their aging infrastructure or patch vulnerable operating systems, the researchers analyzed a sample set of devices to determine the age of known vulnerabilities running on critical infrastructure. We found that 23% of those devices had vulnerabilities since 2016and nearly 16% had vulnerabilities that were first published in 2013.

– A small but growing number of malware samples point to criminals using the Transport Layer Security (TLS) protocol, which allows network traffic to be encrypted, to hide their activities. This is a cause for concern among security professionals, as it renders detailed packet inspection ineffective as a security tool. The combination of machine learning methods and new data visualizations provides insights into this higher quality trend.

– For the period December 2020 to April 2021, the average TTD was reduced to about 13 hours, well below the current and unacceptable industry estimate of 100 to 200 days. The increases and decreases in TTD observed during this period highlight an ongoing heated “arms race” between attackers and defenders, with adversaries unleashing a constant barrage of new threats that require security vendors to move quickly to identify them.