Saudi Ministry of Education to showcase innovations at 2025 Geneva International Exhibition    7,523 violators of residency, labor, and border security laws deported in a week    Video contradicts Israeli army account of deadly March 23 strike on Gaza paramedics    Saudi Arabia spends over $241 million to implement de-mining projects in 3 countries    Italy's Meloni government approves controversial security decree expanding police protections and penalties    Egypt submits new Gaza ceasefire and prisoner exchange proposal: Report    'Everything is possible' — Ronaldo focused on titles, not 1,000-goal milestone after Riyadh Derby win    Saudi, US military leaders discuss enhanced defense cooperation in Riyadh    King Salman Global Academy for Arabic Language launches program with Indiana University    Ronaldo brace powers Al Nassr past Al Hilal in Riyadh derby thriller    Ed Sheeran weaves Persian music into new song, Azizam    Al-Jadaan: Crown Prince's directives confirm government's ability to bring back balance to real estate market    Veteran Bollywood actor Manoj Kumar dies at 87    Foreign investors are allowed to engage in real estate business outside Makkah and Madinah Commercial speculation should not be the purpose of real estate transaction    Aubameyang fires Al Qadsiah into King's Cup final with stoppage-time winner over Al Raed    Musk's X is suing India, as Tesla and Starlink plan entry    Tesla sales plunge after backlash against Elon Musk    Danilo Pereira fires Al Ittihad into King's Cup final with dramatic stoppage-time double    Screen time in bed linked to insomnia, study finds    Mexico bans junk food in schools to fight childhood obesity epidemic    Sweet sales surge ahead of Eid as Saudi chocolate imports top 123 million kg in 2024    Bollywood actress vindicated over boyfriend's death after media hounding    Grand Mufti rules against posting prayers and preaching in mosques on social media    King Salman prays for peace and stability for Palestinians in Ramadan message King reaffirms Saudi Arabia's commitment to serving the Two Holy Mosques and pilgrims    Exotic Taif Roses Simulation Performed at Taif Rose Festival    Asian shares mixed Tuesday    Weather Forecast for Tuesday    Saudi Tourism Authority Participates in Arabian Travel Market Exhibition in Dubai    Minister of Industry Announces 50 Investment Opportunities Worth over SAR 96 Billion in Machinery, Equipment Sector    HRH Crown Prince Offers Condolences to Crown Prince of Kuwait on Death of Sheikh Fawaz Salman Abdullah Al-Ali Al-Malek Al-Sabah    HRH Crown Prince Congratulates Santiago Peña on Winning Presidential Election in Paraguay    SDAIA Launches 1st Phase of 'Elevate Program' to Train 1,000 Women on Data, AI    41 Saudi Citizens and 171 Others from Brotherly and Friendly Countries Arrive in Saudi Arabia from Sudan    Saudi Arabia Hosts 1st Meeting of Arab Authorities Controlling Medicines    General Directorate of Narcotics Control Foils Attempt to Smuggle over 5 Million Amphetamine Pills    NAVI Javelins Crowned as Champions of Women's Counter-Strike: Global Offensive (CS:GO) Competitions    Saudi Karate Team Wins Four Medals in World Youth League Championship    Third Edition of FIFA Forward Program Kicks off in Riyadh    Evacuated from Sudan, 187 Nationals from Several Countries Arrive in Jeddah    SPA Documents Thajjud Prayer at Prophet's Mosque in Madinah    SFDA Recommends to Test Blood Sugar at Home Two or Three Hours after Meals    SFDA Offers Various Recommendations for Safe Food Frying    SFDA Provides Five Tips for Using Home Blood Pressure Monitor    SFDA: Instant Soup Contains Large Amounts of Salt    Mawani: New shipping service to connect Jubail Commercial Port to 11 global ports    Custodian of the Two Holy Mosques Delivers Speech to Pilgrims, Citizens, Residents and Muslims around the World    Sheikh Al-Issa in Arafah's Sermon: Allaah Blessed You by Making It Easy for You to Carry out This Obligation. Thus, Ensure Following the Guidance of Your Prophet    Custodian of the Two Holy Mosques addresses citizens and all Muslims on the occasion of the Holy month of Ramadan    







Thank you for reporting!
This image will be automatically disabled when it gets reported by several people.



CISOs warned against ‘sharpened skills' of attackers, says IBM study
Published in The Saudi Gazette on 03 - 10 - 2013

JEDDAH – Chief Information Security Officers (CISO's) must increase their knowledge of the evolving vulnerability and attack landscape, such as mobile and social technologies, to more effectively combat emerging security threats, Today, IBM's X-Force 2013 Mid-Year Trend and Risk Report revealed Wednesday.
For CISO's, it's no surprise that tried and true attack tactics can cause the most damage to an enterprise. Known vulnerabilities left unpatched in Web applications and server and endpoint software, create opportunities for attacks to occur. These unpatched applications and software continue to be facilitators of breaches year after year. However, the latest X-Force report also recognizes that attackers are improving their skills, which allows them to increase their return on exploitation. These attackers are capitalizing on users' trust when it comes to new vectors like social media, mobile technology and waterhole attacks.
At the mid-year of 2013, attackers continue to focus on exploiting trusted relationships, via social networks from professional-looking spam, to sending malicious links that appear to be from friends or people that you “follow.” These attacks do work, providing an entry point into organizations. In their defense, social networks have taken more proactive measures in pre-scanning links included in public and private posts/messages.
Criminals are selling accounts on social networking sites, some belonging to actual people whose credentials were compromised, others fabricated and designed to be credible through realistic profiles and a Web of connections. As a minimum they function to inflate page ‘likes' or falsify reviews; though more insidious uses include hiding one's identity to conduct criminal activities – the online equivalent of a fake ID, but with testimonial friends, adding to the deception.
IBM X-Force expects to see applications of social engineering become more sophisticated as attackers create complex internetworks of identities while refining the art of deceiving victims. Technology advancements and controls are available, best practices continue to be refined and taught, but ultimately the trust the user believes they have may circumvent anything security practitioners put in place.
Attackers focusing on a central, strategic target like special interest Websites that are heavily frequented by a select group of potential targets are an effective and optimized means of exploitation. These central targets may not always have strong security solution and policies deployed, and even if they do, the cost of figuring out how to get through them is worth the opportunity to compromise the user-base.
These “watering hole” attacks are a great example of how operational sophistication is being used to reach targets not previously susceptible. By compromising the central site and using it to serve malware, attackers are able to reach more technically savvy victims who may not be fooled in phishing attempts, but would not suspect that sites they trust could be malicious.
Distributed-Denial-of-Service (DDoS) attacks can be used as a distraction, allowing attackers to breach other systems in the enterprise while IT staffs are forced to make difficult risk-based decisions, possibly without visibility of the full scope of what is occurring. Attackers have demonstrated enhanced technical sophistication in the area of DDoS using methods of increasing the amounts of capable bandwidth as an updated and powerful way to halt business by interrupting online service as well as new DDoS mitigation evasion techniques.
As the scope and frequency of data breaches continues in an upward trajectory, it is more important than ever to get back to basic security fundamentals. While technical mitigation is a necessity, educating users throughout the enterprise that security is a mindset, not an exception, can go a long way toward reducing these incidents. — SG


Clic here to read the story from its source.