Attackers have been using the COVID-19 pandemic to launch new attacks on organisations.
Cybercriminals are evolving their tradecraft with new innovations and increasingly automating their attacks, according to the 2020 Global Threat Intelligence Report (GTIR) launched by NTT, a world-leading global technology services provider. In the UK and Ireland, manufacturing became the most attacked sector, representing almost a third of all attacks, while technology was the most attacked sector globally. The GTIR also highlights the importance of cyber-resilience and security-by-design as cybercriminals look to gain from the COVID-19 pandemic.
A comprehensive view of the threats impacting businesses in EMEA, the Americas and Asia Pacific, as well as emerging trends across different industries, the GTIR reveals that threat actors are innovating faster than ever before. Developing multi-function attack tools and using Artificial Intelligence (AI) and Machine Learning capabilities, attackers are investing in automation techniques; 21% of attacks globally were in the form of a vulnerability scanner. Despite efforts to layer up their defences, many organisations are unable to stay ahead of attackers, while others are struggling to do the basics like patching old vulnerabilities.
UK manufacturing under attack
Manufacturing regularly appears as one of the most attacked industries globally. Most commonly linked to intellectual property (IP) theft, it increasingly faces financially motivated data breaches, global supply chain risks and risks from unpatched vulnerabilities. The UK was the only country (apart from Hong Kong) this year where manufacturing topped the list of most attacked sectors, representing 29% of all attacks, with technology (19%) second and business and professional services (17%) third. Government and finance made up the other two sectors in the top five.
Reconnaissance attacks accounted for half of all hostile activity in the UK and Ireland, with web application the next most common form of attack (22%). Reconnaissance activity (60%) was also the most common attack type against manufacturers followed by web application attacks (36%).
Rory Duncan, Security Go-to-Market Leader, NTT, said: “UK manufacturing has become a major target for attackers in recent years as a result of the increased risks brought about from the convergence of IT and Operational Technology (OT). The biggest worry is that security has lagged behind in this sector, potentially exposing systems and processes to attack. Poor OT security is a legacy issue; many systems were designed with efficiency, throughput and regulatory compliance in mind rather than security. In the past, OT also relied on a form of ‘security through obscurity’. The protocols, formats and interfaces in these systems were often complex and proprietary and different from those in IT systems, so it was difficult for attackers to mount a successful attack. As more and more systems come online, hackers are innovating and see these systems as ripe for attack.”
Duncan added: “Now more than ever, it’s critical for all organisations, regardless of sector or region, to pay attention to the security that enables their business; making sure they are cyber-resilient and secure-by-design, which means embedding privacy and security into the fabric of their enterprise architecture and organisational culture. The current global pandemic and the flow of trusted and untrusted information used to mask the activities of cybercriminals has shown us that they will take advantage of any situation. Organisations must be ready to respond to these and other threats in a constantly evolving landscape.”
The ‘year of enforcement’
The 2020 Global Threat Intelligence Report calls last year the ‘year of enforcement’ with the number of Governance, Risk and Compliance (GRC) initiatives growing, creating a challenging global regulatory landscape. Several acts and laws now influence how organisations handle data and privacy, including the General Data Protection Regulation (GDPR), which has set a high standard for the rest of the world. The report provides organisations with recommendations to help navigate compliance complexity, including identifying acceptable risk levels, building cyber-resilience capabilities and implementing solutions that are secure-by-design.
The 2020 GTIR – the eighth annual report – analyses and summarises trends based on log, event, attack, incident and vulnerability data from trillions of logs and billions of attacks.
Global highlights: 2020 Global Threat Intelligence Report:
• Most common attack types accounted for 88% of attacks: Application-specific (33%), web application (22%), reconnaissance (14%), DoS/DDoS (14%) and network manipulation (5%) attacks.
• Weaponisation of IoT: Botnets like Mirai, IoTroop and Echobot have advanced in automation, improving propagation capabilities. Mirai and IoTroop are also known for spreading through IoT attacks, then propagating through scanning and subsequent infection from identified hosts.
• Old vulnerabilities remain an active target: Attackers leveraged those that are several years old but have not been patched by organisations, such as HeartBleed, which helped make OpenSSL the second most targeted software with 19% of attacks globally. A total of 258 new vulnerabilities were identified in Apache frameworks and software over the past two years, making Apache the third most targeted in 2019, accounting for over 15% of all attacks observed.
• Attacks on Content Management Systems (CMS) accounted for about 20% of all attacks: Targeting popular CMS platforms like WordPress, Joomla!, Drupal, and NoneCms, cybercriminals used them as a route into businesses to steal valuable data and launch additional attacks. Additionally, more than 28% of targeted technologies (like ColdFusion and Apache Struts) support websites.
