Story image

2019’s top three cybersecurity trends - Akamai

07 Jan 2019

Article by Akamai APJ security technology and strategy head Fernando Serto

February 2018 marked a historical event for the internet, the cybersecurity environment, and the evolution of cyber-attacks – a 1.3 Tbps Distributed Denial of Service (DDoS) attack.

The incident, exploiting memcached servers to reflect and amplify attacks, set a record for the largest publicly disclosed DDoS attack in history.

A few days prior to the attack, security organisations began to notice, research, and alert customers on this new DDoS attack method and how it can be exploited to generate much larger attacks. In 2018, organisations of every size need to rethink their security strategies – not only when it comes to external users accessing internal applications, but also how staff interact with applications on a daily basis.

This trend indicates that a zero-trust security model is here to stay.

Throughout the year, there were also a number of cybersecurity trends playing out.

Extortion of cryptocurrencies continuously made headlines, while towards the end of the year saw a rise of bot armies carrying out credential stuffing attacks.

In the evolving security landscape, businesses need to reflect on the incidents from the past year and understand how these will continue to grow and become more complex in their execution.

Therefore, it’s important to outline a number of trends from 2018 and how they will continue to develop in 2019.

The rise of sophisticated ‘low and slow’ credential stuffing attacks

The greatest weakness of any website is the password.

Everyday users, who are challenged with the task of juggling multiple accounts and credentials, tend to re-use the same passwords across different websites.

Following a data breach, malicious actors will obtain large databases of login credentials and employ botnets to rapidly insert these into websites to compromise accounts.

Fortunately, rapid login attempts are usually easily detected and mitigation with velocity-based detection systems.

While this is the traditional approach to credential stuffing, in September 2018 a trend of ‘low and slow’ attacks were identified that fly under the radar of velocity-based systems.

In 2019, Akamai expects the rate of slower attacks to increase, as malicious actors are more successful and remain undetected through this approach.

Cryptocurrency extortion

Following the internet’s largest DDoS attack, in March 2018 investigators found a ransomware note in the attack packets themselves that instructed the victim to transfer cryptocurrency to a Monero wallet address.

This incident of cryptocurrency extortion was added to the long list of extortion attempts in 2018.

In addition, we also saw a sharp rise in cryptojacking attempts through adware-based cryptominning software.

Next year, malicious actors are expected to move away from long-term cryptominers installed on compromised systems and converting to more of a gig-based attack economy.

The gig adversary

Over the past few years, cybercriminals have been moving towards a ‘gig’ economy – an underground community of malicious actors exchanging services.

This ‘cybercriminal gig economy’ is driving specialisation, and marketisation, across different attack verticals.

In the past, adversarial groups were responsible for developing and executing cyber-attacks.

For example, in credential stuffing attacks, previously malicious actors would work on building their own botnets to access and compromise accounts.

Whereas now, with the ‘cybercriminal gig economy’, one adversarial group would build a botnet to determine which accounts they can access with stolen credentials, then sell this information to another group to access and commit fraudulent activities on those accounts.

What this means for businesses is that cyber-attacks are becoming more sophisticated, accessible and purchasable.

We should expect to see further specialisation and monetisation of attacks as the economy grows.

As businesses begin to prepare for 2019, it’s important to observe ongoing patterns in cyber-attacks, as these will continue to evolve and advance.

Akamai also expects to see sophisticated phishing attacks, which target users who have network connectivity to servers in the environment, to exploit vulnerable software within the organisation.

Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.
Ransomware’s decline equals cryptomining’s rise
ESET’s Security Days Conference recently took place to go over the current threat environment and what to look out for next.
IoT and DDoS attacks: A match made in heaven
A10 Network’s Adrian Taylor uses findings from a number of reports to illustrate his point that advances in technology are facilitating cybercrime.
ForgeRock launches Sandbox-as-a-Service to facilitate compliance
The cloud-based testing environment for APIs enables banks to accelerate compliance with Open Banking and PSD2 deadlines.
Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.