10 Emerging Threats Your Company May Not Know About

10 Emerging Threats Your Company May Not Know About

By Debra Donston-Miller

May 2013

http://www.darkreading.com/vulnerability-threats/util/10937/download

In this white paper Debra Donston-Miller discusses some emerging threats that many companies are not aware of.

At the top of the list of emerging new threats are imbedded systems. An increasing number of these devices have Internet systems imbedded into them. For the network standpoint these devices act like just another PC or server. These devices have the potential for an attacker to use them to compromise or penetrate a network. Network administrator likely do not even know the location of all these devices. One research stated, “Companies have been further integrating mobile devices into their networks, into their environments. You basically have this little computer that you use to [for example] make phone calls that also has access to all of your corporate resources.”

The increasing use of mobile devices will become a major security threat. Employees bring their personal devices into the workplace and use them to access company resources. There is often little security controls over these devices. It is especially important is to educate users on security with mobile devices. Many of these devices have 3G/4G service. These devices can give access to the company's network that bypasses all companies security controls. Administrators would have no idea what traffic is flowing outside of the company. Hackers could install malware to give then access to the network through the device's 3G/4G access.

App stores are another security threat to mobile devices. Every device maker has its own app store. Not all vendors make sure that these apps are properly vetted for security. Apple requires that all its apps are signed by the vendor but Android apps can be self-signed. The app stores could be a means of installing malware.

A growing threat to network security is what the paper calls the “comsumeriztion of IT”. As the price of equipment comes down and cloud service are becoming widely available, more and more people are gaining access to what were once enterprise only applications. These users can set their own networks systems up but have little understanding of the security issues involved. There is a danger that these users could set up their own hardware, software, and services without the company's IT department knowing it.

There will also be a growing risk of what is referred to as “accidental cyber threats”. This is caused when company data users expose company data through carelessness. This could happen when someone takes sensitive data home on a USB drive, sends it to a cloud service like Dropbox, or sends it to a personal email account. Users could be working remotely on an unsecured network.

Another risk that few companies consider is the risk from the equipment supply chain. Many companies are buying equipment on the “gray market” through places like Ebay. Besides the risk of getting defective or substandard equipment, there are serious security risks. The seller could install malware or backdoors on this equipment.

Cyber espionage is a growing danger. The Pentagon has accused the Chinese government of targeting US computer systems for intrusion. The Chinese aren't just targeting the US government but a wide range of businesses. They are stealing a wide range of valuable technology and trade secrets. Other actors are also involved in cyber espionage. These attacks are highly advanced and difficult to guard against. Even smaller companies are being attacked.

With the growing popularity of social media, there is a danger that people will expose confidential company information on their personal sites. For instance, someone could let out the release data of a new product while talking about work on Facebook.

A new type of malware called ransomware is emerging. Ransomware either locks the screen up or encrypts the data on the system. Companies often will quietly pay the attacker to unlock the system rather than go through a long legal battle.

The paper also describe the growing use of “watering hole attacks”. Hacker injects code into sites their targets are likely to visit. There is no need for direct contact that way. Tibetan sympathizers have been spied on this way.

As technology advances, the attack surface on network systems is growing. Average users have the means to seriously compromise a network system, even if it is done unintentionally. The paper stresses the need to educate the users on security issues.