A growing percentage of cyberattacks are using encryption to avoid detection, according to a new report by Zscaler’s ThreatLabZ researchers. Their report, summarized by Help Net Security, highlights the ways attackers are making security platforms work much harder to identify malicious activity. Last year, Zscaler’s platform detected and blocked 2.7 million encrypted phishing attacks per month. It also found that 32 percent of newly-registered, potentially malicious domains were using SSL certificates.
“With the ever-increasing concerns over data privacy, there has been a massive trend toward Internet properties having encryption by default,” said Zscaler’s Chief Technology Officer Amit Sinha. “This is a great thing for privacy, but it presents a challenge to IT security. Decrypting, inspecting, and re-encrypting traffic is nontrivial, causing significant performance degradation on traditional security appliances, and most organizations are not equipped to inspect encrypted traffic at scale.”
In total, Zscaler blocked 1.7 billion attacks executed over SSL between July and December of 2018. “With a high percentage of threats now delivered with SSL encryption, and over 80 percent of Internet traffic now encrypted, enterprises are blind to over half of malware sent to their employees,” Sinha continued. The use of encryption for these attacks allows malicious activity to take place without victims knowledge.
“One of the most notable SSL threat trends that we saw in 2018 was the increase in JavaScript skimmer-based attacks. These attacks start with the e-commerce sites being compromised and injected with malicious, obfuscated JavaScript, which, in turn, tries to tap into purchase transactions,” said Deepen Desai, Zscaler’s Vice President of Security Research. “With the increase in JavaScript skimmer-based attacks, criminals can conduct their nefarious activity within the confines of the SSL environment, leaving most e-commerce sites unaware of the activity.”
Security platforms are fighting an uphill battle to keep up with the tactics used by attackers. New-school security awareness training is an essential complement to technical defenses, because it can enable your employees to identify any malicious activity that slips through the cracks.
Help Net Security has the story: https://www.helpnetsecurity.com/2019/03/01/2019-cloud-security-insights-threat-report/
Free Phishing Security Test
Find out what percentage of your employees are Phish-prone™
Would your users click on the phishing emails that make it through your filters? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here's how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:
