Main findings: cyberattacks
Malware Hidden in Encrypted Traffic:
Cybercriminals use encryption techniques to evade detection by concealing command-and-control activity. Malware detected using encrypted network communications between November 2016 and October 2017 (a 12-month period) more than tripled, rising from 19% to 70%.
Network-based ransomware:
In 2017, network-based ransomware worms proliferated. This eliminates the need for human intervention and facilitates self-propagation. Furthermore, these cyberattacks often masquerade as ransomware when their primary objective is the destruction of systems, services, and data (e.g., Nyetya), with the potential to even cripple the internet.
IoT Botnets and DDoS
Attacks: IoT botnets (zombie networks of IoT devices) are growing in size, reach, and power. They are used to launch distributed denial-of-service (DDoS) attacks that also exploit the application layer. However, only 13% of organizations (globally) see IoT botnets as an imminent threat, and they continue to add IoT devices to their networks in bulk and without IoT security.
Key findings: cyber defenses
Increased complexity:
Defenders are implementing multi-vendor solutions to protect themselves against security vulnerabilities. This increased complexity, coupled with the rise in security vulnerabilities, reduces organizations' cybersecurity capabilities.
• In 2017, 21% of Spanish security professionals reported using solutions from 11 to 20 vendors (23% in EMEAR and 25% globally). Nearly 50% find this situation complex or very complex to manage.
• 74% of security professionals consider managing multiple security alerts complicated or very complicated (global figure).
Cloud usage is growing
• 25% of Spanish security managers confirmed they are using external (off-premise) private clouds; 23% in EMEAR and 27% globally.
• Among Spanish organizations that use them, 48% host networks in the cloud for improved data security and 46% for ease of use. EMEAR figures: 53% and 47%. Global figures: 57% and 46%, respectively.
Although the cloud offers improved data security, cyberattacks exploit the fact that security teams struggle to defend against the ever-changing and expanding multi-cloud environments. Combining best practices, advanced technologies like machine learning, and cloud security platforms can help protect this environment.
Network Behavior Analysis Tools
• 93% of respondents in Spain stated that network behavior analysis tools work adequately (91% in EMEAR and 92% globally).
• 83% rely on automation to reduce their effort and strengthen cybersecurity (global figure).
• 74% already use AI/machine learning (global figure).
Uninvestigated alerts
• 44% of alerts are not investigated (global figure). Of those that are investigated (56%), 34% are legitimate. And of those, almost half (49%) remain unresolved.
Bet on IT security outsourcing
• 49% of security professionals outsourced security monitoring services in 2017 (global figure), compared to 44% in 2016.
• 47% outsourced incident response (42% in 2016) and 54% opted for security consulting services (51% in 2016, global figures).
Time to Detection (TTD):
The number of malware samples detected by Cisco researchers increased tenfold between 2016 and 2017. A lower TTD helps defenders act more quickly to stop it. Cisco's TTD has been reduced to approximately 4.6 hours. The use of cloud-based security technology has been a key factor in achieving and maintaining this low average TTD.
Cisco Recommendations
• Educate employees by role for greater effectiveness
• Confirm that corporate policies and practices are being followed for patching applications, systems, and devices
• Take ownership of IoT device security and strengthen its defense capabilities
• Utilize advanced security analytics tools, AI, and machine learning more extensively
• Access accurate data and threat intelligence processes in a timely manner
• Back up data more frequently and test the functionality of restoration processes
• Review the effectiveness of third-party cybersecurity to reduce the risk of supply chain attacks
• Analyze the cybersecurity of microservices environments, cloud services, and application management systems
