Cybercriminals Are Getting Rich from Our Security Failures

Five Reasons Why Information Security Is Everyone’s Job

Thanks to a new report from Trustwave, it is easy to see why cybercrime has become so prevalent. It pays very well.

The 2015 Trustwave Global Security Report (free download with registration) looked at all sorts of issues on the cybersecurity front, from spam to passwords to where compromises are actually happening. Though the report presented a fascinating and all-encompassing look at the state of cybersecurity today, unfortunately, it isn’t pretty.

The bit of information that appears to have caught the most attention is how lucrative cybercrime is for hackers. The report stated that hackers receive an estimated 1,425 percent return on investment for exploit kit and ransomware schemes, or nearly $6000 for a single ransomware campaign. That’s a stunning amount of money. TechWeek Europe explained why cybercrime is so lucrative:

Based on Trustwave estimates that 0.5 percent of infected victims will pay a $300 ransom to free their units, this adds up to equivalent profits of over $90,000, without the criminals ever needing to write a single line of code.

In an eWeek article, Karl Sigler, threat intelligence manager at Trustwave, doesn’t let users off the hook for their role in helping hackers to get rich. He said that the exploit kits are searching for, well, something to exploit, and users aren’t doing a good enough job at patching existing vulnerabilities, and essentially, that allows the bad guys to waltz right in and take over.

The report found that getting into a system is pretty darned easy, too. Almost all – 98 percent – of the applications that were tested were found to be vulnerable, and many are helping things along by using weak passwords as in 28 percent of breaches.

As I read over the report, I was hard pressed to find anything positive coming from it. Lessons weren’t learned from the Target breach, for instance, as retail continues to lead the way in compromises, making up 43 percent of the breaches that Trustwave investigated for the report. Point of sale systems continue to be a security failure: 95 percent of food-and-beverage industry compromises and 65 percent of hospitality industry compromises were at POS systems, and these same systems were the reason for 40 percent of ecommerce-related breaches.

How do we address this major security meltdown? It appears the big change needs to happen in small ways. Inside of the average business, it all goes back to education: teaching why it is vital to apply patches immediately and to have employees ask for help before falling for ransomware attacks. It also involves companies re-evaluating their POS security and instituting the new credit card systems that are supposed to be online in October. As well, we must encourage everyone to be smarter about creating passwords and begin instituting multi-factor authentication.

I’m sure at this point I sound like a broken record on cybersecurity, because this is hardly the first time I have called for better security education and an improved focus on these issues. But as we can see from this report, businesses and users still aren’t learning the lesson, and until we do, I will continue to call for improvements.

Sue Marquette Poremba has been writing about network security since 2008. In addition to her coverage of security issues for IT Business Edge, her security articles have been published at various sites such as Forbes, Midsize Insider and Tom’s Guide. You can reach Sue via Twitter: @sueporemba