Unseen Threats, Imminent Losses

The number of reported vulnerabilities related to supervisory control and data acquisition (SCADA) systems increased since the second half of 2017, and many of these vulnerabilities were found in human-machine interface (HMI) software. The SCADA HMI is the main digital hub that manages critical infrastructure, and the data it shows has some reconnaissance value for attackers.

Our data also indicates that more vendors were able to create patches or mitigation methods in time for the corresponding vulnerability announcements. While this is a welcome improvement, the sheer number of discovered vulnerabilities highlights why enterprises in critical infrastructure sectors should stay on top of SCADA software systems and invest in multilayered security solutions. The European Union (EU), through the Network and Information Security (NIS) Directive, has already mandated its member states to enact laws that ensure a heightened level of security for critical sectors and essential digital services.

Using the relevant 2017 and 2018 data sets from Privacy Rights Clearinghouse, we saw a 16-percent increase in reported U.S.-based data breaches.

It was interesting to see that the number of incidents due to unintended disclosures was higher, albeit only slightly, than that due to hacking.

Fifteen of the 1H 2018 data breaches were mega breaches, that is, each exposed at least one million records. In terms of number of incidents, the healthcare industry suffered the most breaches, but most of the mega breaches were from retailers and online merchants. We also found at least nine breaches outside the U.S. that could be considered mega breaches.

There are substantial consequences for enterprises that are hit by data breaches. Recovery and notification costs, revenue losses, patching and downtime issues, and potential legal fees can add up: A mega breach can cost companies up to US$350 million. Also, many countries are establishing new data privacy regulations that impose hefty fines for improper data management.

The EU in particular has taken a strong stance on privacy by implementing one of the toughest and most extensive data protection laws in the world: the General Data Protection Regulation (GDPR). This regulation, enforced in May this year, sets a high bar for data security and privacy protection. It imposes considerable fines for noncompliant organizations: Penalties could reach up to €20 million or 4 percent of the noncompliant company’s global annual turnover, whichever is higher. Moreover, it has quite a long reach since any organization holding EU citizens’ data is affected.

GDPR – Are you compliant?

To persist against continually improving detection techniques, malware developers are constantly fine-tuning their evasion methods. In the first half of 2018, a few approaches stood out: using fileless threats, using macros, and manipulating file sizes.

Typical threats involve malicious files that are installed and executed in the compromised device. Fileless threats don’t operate that way. Instead, they hijack trusted tools that are built into the operating system to carry out the attacks.

We detected a rising trend in the number of fileless threats throughout the first half of the year. Enterprises can stay ahead of these threats by deploying integrated layers of protection across the network.

We also saw an uptick in the use of malicious macros. Powload was the most pervasive culprit and, like most malicious macros, it was being sent through spam. The spam email is crafted in such a way that manipulates users into enabling the macro and downloading the malware payload.