sb-as logo
Story image

2019’s top three cybersecurity trends - Akamai

07 Jan 2019

Article by Akamai APJ security technology and strategy head Fernando Serto

February 2018 marked a historical event for the internet, the cybersecurity environment, and the evolution of cyber-attacks – a 1.3 Tbps Distributed Denial of Service (DDoS) attack.

The incident, exploiting memcached servers to reflect and amplify attacks, set a record for the largest publicly disclosed DDoS attack in history.

A few days prior to the attack, security organisations began to notice, research, and alert customers on this new DDoS attack method and how it can be exploited to generate much larger attacks. In 2018, organisations of every size need to rethink their security strategies – not only when it comes to external users accessing internal applications, but also how staff interact with applications on a daily basis.

This trend indicates that a zero-trust security model is here to stay.

Throughout the year, there were also a number of cybersecurity trends playing out.

Extortion of cryptocurrencies continuously made headlines, while towards the end of the year saw a rise of bot armies carrying out credential stuffing attacks.

In the evolving security landscape, businesses need to reflect on the incidents from the past year and understand how these will continue to grow and become more complex in their execution.

Therefore, it’s important to outline a number of trends from 2018 and how they will continue to develop in 2019.

The rise of sophisticated ‘low and slow’ credential stuffing attacks

The greatest weakness of any website is the password.

Everyday users, who are challenged with the task of juggling multiple accounts and credentials, tend to re-use the same passwords across different websites.

Following a data breach, malicious actors will obtain large databases of login credentials and employ botnets to rapidly insert these into websites to compromise accounts.

Fortunately, rapid login attempts are usually easily detected and mitigation with velocity-based detection systems.

While this is the traditional approach to credential stuffing, in September 2018 a trend of ‘low and slow’ attacks were identified that fly under the radar of velocity-based systems.

In 2019, Akamai expects the rate of slower attacks to increase, as malicious actors are more successful and remain undetected through this approach.

Cryptocurrency extortion

Following the internet’s largest DDoS attack, in March 2018 investigators found a ransomware note in the attack packets themselves that instructed the victim to transfer cryptocurrency to a Monero wallet address.

This incident of cryptocurrency extortion was added to the long list of extortion attempts in 2018.

In addition, we also saw a sharp rise in cryptojacking attempts through adware-based cryptominning software.

Next year, malicious actors are expected to move away from long-term cryptominers installed on compromised systems and converting to more of a gig-based attack economy.

The gig adversary

Over the past few years, cybercriminals have been moving towards a ‘gig’ economy – an underground community of malicious actors exchanging services.

This ‘cybercriminal gig economy’ is driving specialisation, and marketisation, across different attack verticals.

In the past, adversarial groups were responsible for developing and executing cyber-attacks.

For example, in credential stuffing attacks, previously malicious actors would work on building their own botnets to access and compromise accounts.

Whereas now, with the ‘cybercriminal gig economy’, one adversarial group would build a botnet to determine which accounts they can access with stolen credentials, then sell this information to another group to access and commit fraudulent activities on those accounts.

What this means for businesses is that cyber-attacks are becoming more sophisticated, accessible and purchasable.

We should expect to see further specialisation and monetisation of attacks as the economy grows.

As businesses begin to prepare for 2019, it’s important to observe ongoing patterns in cyber-attacks, as these will continue to evolve and advance.

Akamai also expects to see sophisticated phishing attacks, which target users who have network connectivity to servers in the environment, to exploit vulnerable software within the organisation.

Story image
Five Eyes nations want legal access to backdoors to fight 'illegal content'
The nations argue that encryption can make the enforcement of public safety difficult, particularly when it comes to serious problems like child exploitation. More
Link image
Why the threat of ransomware requires quality resources to keep it at bay
With this ransomware prevention kit, learn actionable tactics for IT departments on how to manage backups and enable staff so that ransomware is a managed and controlled risk.More
Story image
Gartner names ThreatQuotient a representative vendor for SOAR
The company is listed in Gartner’s 2020 Market Guide for Security Orchestration, Automation and Response Solutions.More
Story image
Interview: How cyber hygiene supports security culture - ThreatQuotient
We spoke with ThreatQuotient’s APJC regional director Anthony Stitt to dig deeper into cyber hygiene, security culture, threat intelligence, and the tools that support them.More
Story image
CrowdStrike targets Zero Trust blind spot with new offering
CrowdStrike has officially launched CrowdStrike Falcon Zero Trust Assessment (ZTA), designed to aid in overall security posture by delivering continuous real-time assessments across all endpoints in an organisation regardless of the location, network or user. More
Story image
Report reveals relationship between boardroom and cybersecurity investments
“While boards are definitely listening and stepping up with increased budget for cybersecurity, they tend to view any investment as a cost rather than adding business value."More