More

    Cybersecurity Grades Released for Key Industries

    Traditionally, the complex world of cybersecurity has been left solely to information security professionals to defend the organization’s sensitive information and systems. But the recent spate of high-profile data breaches and warnings from regulators has caught the attention of C-level executives and board members. Cybersecurity is no longer just a technical issue, as a breach can have a major impact on the viability of an organization – loss of brand reputation, jobs, customers and partners, and most importantly a negative impact on the bottom line.

    Now that execs recognize the need to prioritize cybersecurity, where do they begin? Understanding the cyber risks an organization faces and extrapolating the potential business impact is tough using traditional cybersecurity solutions, which produce volumes of low-level, machine-based data. This method requires significant effort and resources to understand whether a threat is relevant to the business, how big an impact it could have, and how to address it.

    Translating the fire hose of threat data into information that can be easily understood and used to educate the rest of the organization is an approach taken by SurfWatch Labs, a provider of cyber risk intelligence solutions. Looking at cyber data through a business intelligence lens ensures that security-related trends and potential impacts to organizations can be understood and effectively addressed. This slideshow contains a high-level view of cyber risk analysis contained in SurfWatch Cyber Risk Reports, which aggregate, standardize and analyze cyber-related information for the top four most active industries.

    Jason Polancich, founder and chief architect, SurfWatch Labs, is a serial entrepreneur focused on solving complex Internet security and cyber-defense problems, with more than 20 years of experience as an intelligence analyst, software engineer, systems architect and corporate executive. Prior to founding SurfWatch Labs, Mr. Polancich co-founded Novii Design, which assisted the U.S. intelligence community and Department of Defense in building some of the largest data warehouse and analysis systems ever put into operation within the government and defense contracting sectors.

    Cybersecurity Grades Released for Key Industries - slide 1

    Click through for a high-level cyber risk analysis of key industries for June 2014, provided by Jason Polancich, founder and chief architect, SurfWatch Labs.

    Cybersecurity Grades Released for Key Industries - slide 2

    Financial Services Sector Grade: F

    An industry’s grade is determined by combining both positive and negative cyber events in the sector during that month. SurfWatch Analytics, a data warehouse and cyber risk analytics engine, generates CyberFacts, which tell you who was attacked, how and what the results were.

    Who experienced the most negative cyber events in the financial sector? Top 3 Companies:

    • Move, Inc. – realtor.com and others (26.7 percent)
    • American Express (16.3 percent)
    • Citigroup (7.0 percent)

    According to the CyberFacts, these three companies suffered the most negative cyber events in the month of June. Move, Inc. was the victim of a DDoS attack, American Express notified customers of two data breaches, and Citigroup failed a Federal Reserve stress test.

    Cybersecurity Grades Released for Key Industries - slide 3

    Financial Services Sector Grade: F

    How did the bad guys get in? Top 3 practices:

    • Malware (49.5 percent)
    • Social engineering (21.8 percent)
    • Unauthorized access (14.3 percent)

    According to the CyberFacts, these are the top three practices used by cyber criminals to breach financial services firms in the month of June 2014. Notable malware used in attacks on financial firms was the Zeus Trojan, in addition to newer malware types such as Soraya, Dyreza, Dyre and VAWTRAK.

    Cybersecurity Grades Released for Key Industries - slide 4

    Financial Services Sector Grade: F

    What did this mean for financial service organizations? Top 3 effects:

    • Infected/exploited assets (19 percent)
    • Credentials stolen/leaked (17.2 percent)
    • Data stolen/leaked (15.1 percent)

    According to the CyberFacts, infected/exploited assets centered around malware practices and network attacks involved in compromising login accounts and network integrity – to use as part of a current or future attack. The next highest effects highlight the difference between the types of data stolen/lost – whether it was information about a person (Social Security number) or credentials, which might be more focused on bank account login information.

    Cybersecurity Grades Released for Key Industries - slide 5

    Consumer Goods Sector Grade: C+

    An industry’s grade is determined by combining both positive and negative cyber events in the sector during that month. SurfWatch Analytics, a data warehouse and cyber risk analytics engine, generates CyberFacts, which tell you who was attacked, how and what the results were.

    Who experienced the most negative cyber events in the consumer goods sector? Top 3 Companies:

    • Taboola (21.6 percent)
    • Reuters (21.6 percent)
    • P.F. Chang’s (8.1 percent)

    According to the CyberFacts, these three companies suffered the most negative cyber events in the month of June 2014. Taboola, an ad network company, was the victim of a phishing attack, Reuters was infiltrated by the Syrian Electronic Army through the Taboola phishing attack, P.F. Chang’s had credit card information stolen from its POS system.

    Cybersecurity Grades Released for Key Industries - slide 6

    Consumer Goods Sector Grade: C+

    How did the bad guys get in? Top 3 practices:

    • Unauthorized access (34 percent)
    • Network Attack (23.5 percent)
    • Malware (21.9 percent)

    According to the CyberFacts, these are the top three practices used by cyber criminals to breach consumer goods organizations in the month of June. While unauthorized access was the largest attack method in June, it was down significantly from the previous month. Network attacks such as DDoS and malware, distributed via malvertising, were the next top methods used by cyber criminals.

    Cybersecurity Grades Released for Key Industries - slide 7

    Consumer Goods Sector Grade: C+

    What did this mean for consumer goods organizations? Top 3 effects:

    • Infected/exploited assets (26.2 percent)
    • Data stolen/leaked (15.5 percent)
    • Service Interruption (10.5 percent)

    According to the CyberFacts, infected/exploited assets were primarily due to instances of malware compromising a device. Data stolen/leaked, which usually centers on payment card data for this industry, focused more on stolen personal information and user credentials this month.

    Cybersecurity Grades Released for Key Industries - slide 8

    IT Sector Grade: D-

    An industry’s grade is determined by combining both positive and negative cyber events in the sector during that month. SurfWatch Analytics, a data warehouse and cyber risk analytics engine, generates CyberFacts, which tell you who was attacked, how and what the results were.

    Who experienced the most negative cyber events in the IT sector? Top 3 Companies:

    • DevHD (26.8 percent)
    • Evernote (16.9 percent)
    • Code Spaces (5.6 percent)

    According to the CyberFacts, these three companies suffered the most negative cyber events in the month of June 2014: DevHD, Evernote Corp. and Code Spaces all were targets of different DDoS attacks.

    Cybersecurity Grades Released for Key Industries - slide 9

    IT Sector Grade: D-

    How did the bad guys get in? Top 3 practices:

    • Malware (31.2 percent)
    • Network Attack (27.4 percent)
    • Social Engineering (9.7 percent)

    According to the CyberFacts, these are the top three practices used by cyber criminals to breach IT organizations in the month of June. The top trending practices were malware, consisting of the Blackshades RAT, GameOver Trojan, and a variety of ransomware, and network attacks, consisting of DDoS and DNS amplification.

    Cybersecurity Grades Released for Key Industries - slide 10

    IT Sector Grade: D-

    What did this mean for IT organizations? Top 3 effects:

    • Service Interruption (18.7 percent)
    • Infected/Exploited Assets (15.5 percent)
    • Device Hijack (14.2 percent)

    According to the CyberFacts, service interruption and infected/exploited assets were primarily due to the numerous DDoS attacks that hit the industry in the month of June.

    Cybersecurity Grades Released for Key Industries - slide 11

    Global Government Sector Grade: A+

    An industry’s grade is determined by combining both positive and negative cyber events in the sector during that month. SurfWatch Analytics, a data warehouse and cyber risk analytics engine, generates CyberFacts, which tell you who was attacked, how and what the results were.

    Who experienced the most negative cyber events in the government sector? Top 3 Government Organizations:

    • Brazilian Government (18 percent)
    • Brazilian Federal Police (6 percent)
    • Central Election Commission of Ukraine (3 percent)

    According to the CyberFacts, the Brazilian government and federal police were the top targets, related to all of the World Cup protests. In Ukraine, the presidential election was a key driver for hackers trying to modify results, though the malware was identified and stopped from running its operations.

    Cybersecurity Grades Released for Key Industries - slide 12

    Global Government Sector Grade: A+

    How did the bad guys get in? Top 3 practices:

    • Hacking Operation (15.3 percent)
    • Malware (14.2 percent)
    • Unauthorized Access (10.8 percent)

    According to the CyberFacts, hacking operation as a top practice was driven primarily by hacktivists protesting the 2014 FIFA World Cup, while malware focused around the Gameover Zeus botnet and ransomware. Unauthorized access also included hacktivist-driven activity around the World Cup.

    Cybersecurity Grades Released for Key Industries - slide 13

    Global Government Sector Grade: A+

    What did this mean for government organizations? Top 3 effects:

    • Charges and penalties (47.3 percent)
    • Service Interruption (13.6 percent)
    • Infected/Exploited Assets (7.5 percent)

    According to the CyberFacts, charges and penalties led the top effects for the month of June, mostly because of the indictment of the Russian responsible for the Gameover Zeus botnet by the U.S. Department of Justice and FBI law enforcement operation. Service interruption was primarily around hacktivist attacks aimed at Brazilian government websites in protest of the 2014 FIFA World Cup.

    Cybersecurity Grades Released for Key Industries - slide 14

    In closing

    The traditional cybersecurity approach is to drill down into packet data, logs and other technical data streams, but this information is not easily consumed by most employees in an organization and only provides one angle to look at. With a business intelligence approach to cybersecurity, organizations can drill deeper into the data to:

    • understand cyber risk trends over time
    • perform graph-style analysis to isolate connections not easily seen
    • conduct predictive analysis
    • link insights to key actions that the business can take

    Armed with this level of cyber risk intelligence, the C-suite and board members can more effectively allocate resources and make more informed risk mitigation decisions.

    Latest Articles