During 2013, cybercriminals continued the theme of professionalisation of their “industry,” offering easy-to-buy-and-use services that amplified the scale of cybercrime to levels never seen before.
Sophos has released its latest Security Threat Report, which outlines significant changes in cybercriminal behaviour over the course of last year, as well as a forecast for the preferred methods of attack in 2014.
“While many security experts are aware of the high level trends, few have recognised their significance,” says Brett Myroff, CEO of Sophos distributor, NetXactics. “If 2013 has taught us anything, it is that traditional security controls are struggling. These new behaviours are forcing the industry to adapt and change, and widely held best practices must be reconsidered.”
The threat report highlights new security concerns ranging from stealthy malware tools that offer dynamic camouflage and provide attackers with long-term persistent access to users’ data, to the proliferation of connected devices that represent new and often ill-protected targets.
Many new “Internet of Things” devices are becoming commonplace in our homes and everyday infrastructure, offering shadier cybercriminals the potential to impact our daily lives, rather than just the traditional theft of financial information.
“These trends are set to continue in 2014 as threats become even smarter, shadier and stealthier,” says Myroff.
In 2014 Sophos predicts greater focus from cybercriminals on high quality and convincing phishing and social engineering to compensate for harder-to-exploit operating systems like Windows 8.1; embedded devices (such as POS systems, medical systems and new “smart” infrastructure) will open old wounds as security mistakes eliminated in the modern PC environment are carelessly re-implemented; attacks on corporate and personal data in the cloud will continue to grow as providers struggle to refine the security strategy in this new computing platform; and malware for mobile is set to become as sophisticated as its PC relatives.
Sophos advises that in 2014 companies need to watch not only the evolution of existing attacks, but be prepared for dangerous new threats that are emerging and that have not been dealt before. “As the industry adapts and enhances protection mechanisms to cover new devices and threats, this is increasingly becoming an issue for every member of society, not just for government and business,” Myroff adds.