CyberheistNews Vol 3, 27

Scam Of The Week: 4th Of July

Cybercriminals have a planned marketing agenda just like real companies. They take advantage of current events, catastrophes and holidays to try to trick people into clicking on links. This year they have taken our 4th of July to start a phishing campaign that supposedly sends a patriotic eCard but the email contains a malware payload. If this thing slips through the PC's antivirus and gets opened, it infects the PC with malware that makes it into a zombie. Oh, and while we are at it, there are also 100% criminal 4th of July-themed websites with "Buy Now Specials" which have as their only goal to get the victim's credit card information. Remind your users: Think Before You Click!

How To Win The War Against Cybercrime

Price Waterhouse (PwC) and CSO Magazine just released their 2013 State of Cybercrime Survey. It shows that lack of risk awareness means companies are poorly defended. This is their 11th survey and the trends are not good. Reason is that cybercrime is skyrocketing but cyber security budgets are not keeping up and are too low to cope with this new threat. Or are they?

The survey was done over 500 U.S. executives, security experts and others from both public and private sectors. It is true that the bad guys are winning the cybercrime war at the moment. Is it because the good guys have not caught up to this new enemy and because of that, they are not fighting back effectively?

Or perhaps they know very well what the problem is, but have determined that it is a calculated risk and the disruption to the business to fix it would be worse suffer through a successful data breach.

Some proof that awareness lacks is recent research which shows simulated phishing attacks catch 33% of C-level executives who are taking the bait and fall for simple or sophisticated spear phishing attacks.

"There were no significant changes in C-Suite threat awareness, no spikes in spending on cyber-defense, no breakthroughs in the use of technology to combat cybercrime, and no significant change in the ability of organizations to measure the impact of both cybercrimes committed by insiders and those caused by external cyberattacks," the survey reported.

That, according to Dave Burg, PwC Global and US advisory cyber security leader, has been the case for a decade. "(We) have seen virtually no movement by survey respondents in the past 10 years," he said.

"Possibly the most alarming theme that came out of this year's survey results was that U.S. organizations are misjudging the severity of risks they face from cyber-attacks from a financial, reputational, and regulatory perspective," said Bob Bragdon, vice president and publisher, CSO.

Over the last five years, cybercrime has gone pro. This is now a 3 Billion dollar industry, with a well-developed underground economy which has full-blown escrow services that allow criminals to do buy and sell illegal services and stolen data.

A survey like this sometimes makes for great ammo to get more security budget, but only if you can present a good business case showing your C-level execs a solution to that risk which is less disruptive and less expensive to the organization than suffering a data breach.

IT Security company Trend Micro's recent research showed that 91% of successful data breaches started with a spear-phishing email. This type of social engineering attack can only be repelled by high quality security awareness training for all employees from the Board down to the mail room. Did you know that security awareness training has great ROI and give you an enormous bang for your budget? Check out:
http://www.knowbe4.com/products/kevin-mitnick-security-awareness-training/

Did You Know?

"On average, every three minutes, organizations encounter one malware event that successfully evaded traditional, signature-based defenses." --FireEye Advanced Threat Report 2H 2012

"Email is still the most commonly used channel for corporate communications. As a result, it has become a conduit of targeted attacks and a potential source of data loss." -- Peter Firstbrook, Gartner "Email Security Focus Shifts to Address the Risks of Targeted Attacks and Data Loss", 2013

"200,000 unique new malware samples being produced on an industrial scale every day, which is practically impossible for any signature-based AV software system to cope with." -David Emm, Kaspersky Labs UK, 2013

Quotes of the Week

"The thousands of criminals I have seen in 40 years of law enforcement have had one thing in common: Every single one was a liar." - J. Edgar Hoover

"Life and liberty can be as much endangered from illegal methods used to convict those thought to be criminals as from the actual criminals themselves." - Earl Warren


Thanks for reading CyberheistNews! But if you want to unsubscribe, you can do that right here