Advanced Attacks On The Rise For Larger Companies

Malware is increasingly being used as advanced persistent threat attacks against enterprises, according to the latest quarterly report from Cisco.

There were 287,298 “unique malware encounters” in June 2011, double what was found in March, according to a Global Threat Report from Cisco Security Intelligence Operations released on 1 August. Since the beginning of 2011, unique malware encounters have nearly quadrupled, Cisco said.

Malware evolution

In the report, Cisco researchers did not restrict a malware encounter to just malware infecting a single system. It can also include incidents when a system was initially infected by a basic downloader, which analysed the system and downloaded even more sophisticated data collecting malware.

“Malware has evolved along with the Internet and is now the tool of choice for would-be attackers,” wrote Gavin Reid, manager of the computer Security Incident Response Team at Cisco.

Cyber-attackers rely on malware to “remain surreptitious” so that they can continue to remotely manipulate a system while remaining virtually invisible, Reid said. Detecting APTs like unique malware is not an easy task because there is no “silver bullet” such as a software signature that would identify them on a network, he said.

“If anyone attempts to sell your organisation a hardware or software solution for APTs, they either don’t understand APTs, don’t really understand how computers work, or are lying, or possibly all three,” Reid said.

On average, enterprises had 335 malware encounters per month, Cisco researchers found. March had the highest malware activity during the second quarter, with enterprises seeing an average 455 pieces of malware, followed by an average 453 encounters in April.

The majority of the “malware encounters” occured over the web, the report said, as employees surf the web and land on malicious sites. Despite the increase in encounters, the number of unique malware hosts and unique IP addresses remained relatively consistent between March 2011 and June 2011, according to the report.

Larger companies targeted

Companies with between 5,000 and 10,000 employees and more than 25,000 employees “experienced significantly higher malware encounters” compared to other smaller companies. Companies in the pharmaceutical, chemical, energy and oil sectors continued to be at highest risk of web malware, according to Cisco, although transportation, agriculture, mining and education were also at high risk.

Organisations can improve their abilities to detect and respond to APTs if they have some form of deep packet inspection technology that cover all the important points in the network where traffic is entering or leaving the enterprise. The ability to quickly query network connections or flows through NetFlow or a similar service will also help security managers detect malicious activity.

The organisation should also be able to produce, collect and query logs such as host logs, proxies and authentication and attribution logs. “The more the better,” Reid wrote.

Organisations that have not seen any APT attacks should be concerned, according to Reid, as it doesn’t mean that attackers haven’t targeted it or that the security defenses are working. What’s more likely is that the defenses aren’t picking up on the attack itself. “If you have something of interest and you’re not seeing APT attacks in your organisation, you may need to rethink your detection capabilities,” Reid said.