Network Security

Make sure you have a security policy in place -— The security policy is the formal statement of rules on how security will be implemented in your organization. A security policy should define the level of security and the roles and responsibilities of users, administrators and managers.

Make sure all of your operating systems and applications are patched with the latest service packs and hotfixes -— Keeping your systems patched will close vulnerabilities that can be exploited by hackers.

Keep an inventory of your network devices -— Develop and maintain a list of all hardware/software components, and understand which default software installations provide weak security configurations.

Scan TCP/UDP services -— Turn off or remove unnecessary services. Unneeded services can be the entry point attackers use to gain control of your system.

Establish a strong password policy -— Weak passwords could mean a compromised user account.

Don't trust code from non-trusted sources.

Block certain e-mail attachment types -— This list includes .bas, .bat, .exe and .vbs.

Don't provide more rights to system resources than necessary -— Implement the concept of "least privilege".

Perform your own network security testing -— Find the holes before the attackers do!

Implement "defense-in-depth" -— Don't rely on just one control or system to provide all the security you need.

The year 2017 saw some of the biggest cyber-threats in recent history, with millions of consumers and thousands of businesses affected by everything from the Wanna-cry attack to the Equifax and Uber data breaches. Gartner reports that worldwide, information security spending will reach $86.4 billion by the end of 2017 and the 2017 Cyber-crime Report anticipates cyber-crime damages to cost the world $6 trillion annually by 2021.

So, how can businesses protect themselves from falling victim to next year’s most anticipated security attacks? I’ve compiled a list of five predictions highlighting new and evolving threats to watch out for and protect against in 2018.

1. The cryptojacking “gold rush” will be the top priority for cyber-criminals

Cryptojacking activity began exploding toward the end of 2017 and we suspect that we will see far more activity in 2018, particularly as the value of cryptocurrencies escalates. What makes this kind of activity interesting is how it has created a blurry line between the everyday Internet user and the cyber-criminal. An individual mining cryptocurrency could very well be mining for their own wallet, based on visitors to their own web properties. There is also a very likely chance within those circumstances that disclosed cryptojacking activity could replace advertising on sites to become an entirely new revenue stream. However, the largest portion of cryptojacking is likely to occur from legitimate websites compromised to mine currency for the criminal wallet. Regardless, cryptojacking will be one of the cyber-crime activities to watch in 2018.

2. We will see an increase in Power-Shell-based attacks

Earlier this year, entities of the Saudi Arabian government were compromised using a macro in Microsoft Word to infect the target’s computer with an information-stealing Trojan. Rather than retrieving a binary payload, the attack relied on malicious scripts to maintain persistence on the device and to communicate with compromised websites acting as proxies for the command and control server. These malicious script-based attacks, specifically Power-Shell-based attacks, are incredibly difficult to identify. They can easily evade antivirus engines, making it that much more appealing to cyber-criminals. I predict many more Power-Shell attacks in the year to come.

3. The cyber-criminal underground will continue to evolve and grow

While it may seem like we are already overwhelmed by the amount of cyber-attacks occurring daily, this will not slow down in 2018. In fact, with a recent increase in cyber-criminals tools and a lower threshold of knowledge required to carry out attacks, the pool of cyber-criminals will only increase. This growth is a likely response to news media and pop culture publicizing the profitability and success that cyber-crime has become. Ransomware alone was a $1 billion industry last year. Joining the world of cyber-crime is no longer taboo, as the stigma of these activities diminishes in parts of the world. To many, it’s simply a “good” business decision. At the same time, those already established as “top-players” in cyber-crime will increase their aggressive defense of their criminal territories, areas of operations and revenue streams. We may actually begin to see multinational cyber-crime businesses undertake merger and acquisition strategies and real-world violence to further secure and grow their revenue pipeline.

4. Security software will have a target on its back

In 2018, cyber-criminals will target and exploit more security software. By targeting trusted programs and the software and hardware supply chain, attackers can control devices and wholeheartedly manipulate users. Hackers will leverage and exploit security products, either directly subverting the agent on the endpoint, or intercepting and redirecting cloud traffic to achieve their means. As these events become more publicly known, the public and business perception of security software, particularly that of antivirus solutions, will further deteriorate.

5. More cyber criminals will use worms to launch malware

In 2017, we saw Wanna-cry and Trick-bot use worm functionality to spread malware. More malware families will use this technique in 2018 because network compromise from worms spread faster than many other methods. If hackers can figure out how to use worms without being too noisy (a traditional downfall of this approach), this tactic can amass a large number of victims very quickly.

These predictions are just a handful of the many threats projected to hit 2018. Every year, we see both the caliber and sophistication of breaches reach new heights with respect to loss and damages. At the same time, we are all becoming too comfortably numb with the daily breach headlines. We can’t cross our fingers and hope that our own company or PII (personal identifiable information) isn’t next on the news cycle.

What we can do is enhance awareness, education and training of our employees and IT staff. Our employees are on the front lines of this cyber-crime battle and one avoided click can save hours of down time for IT. At the same time, our solutions need to evolve with the threats and provide multiple layers of protection. With the new year, we have a fresh start and a new security page to write for 2018.