SAN JOSE, Calif. – July 14, 2009 – Cisco today released the Cisco® 2009 Midyear Security Report, which shows that Internet criminals are increasingly operating like successful businesses, borrowing some of the best strategies from legitimate companies and forming partnerships with one another to help make their illegal activities more lucrative.

Today, Cisco security executives will discuss the findings of its Midyear Security Report and will outline best practices in a live interactive IPTV broadcast (it can be found at http://tools.cisco.com/cmn/jsp/index.jsp?id=89479). The midyear edition outlines some of the most common technical and business strategies that criminals use to breach corporate networks, compromise Web sites, and steal personal information and money. In the report, Cisco offers recommendations for protecting against some of the newer types of attacks that have surfaced recently, recommendations that incorporate people, processes and technology as a holistic risk management solution. The report also advises heightened vigilance against some "old school" approaches that are just as sophisticated and prevalent as newer threats.

Highlights

• The Conficker worm, which began infecting computer systems late last year by exploiting a Windows operating system vulnerability, continues to spread. Several million computer systems were under Conficker's control as of June 2009.
• Online criminals are up on current events and making the most of them. After the outbreak of H1N1 influenza ("swine flu") in April, cybercriminals quickly blanketed the Web with spam that advertised preventive drugs and linked to fake pharmacies. Cybercriminals will often seize on major news events to launch this type of attack.  While many spammers continue to operate with extremely high volumes, some are opting for lower-volume but more frequent attacks in an effort to remain under the radar.
• President Barack Obama has made strengthening U.S. cybersecurity a high priority for his administration and looks to work with the international community and the private sector to leverage technology innovations to reduce cybercrime. This focus is expected to have a significant positive impact for the industry in the coming months. John N. Stewart, Cisco's chief security officer and a contributor to the Center for Strategic and International Studies (CSIS) report for the Obama administration, provided additional insight in a recent blog and video blog post.

Specific Threats

• Botnets. These networks of compromised computers serve as efficient means of launching an attack. Increasingly, botnet owners are renting out these networks to fellow criminals, effectively using these compromised resources to deliver spam and malware via the software-as-a-service (SaaS) model.
• Spam. One of the most established ways to reach millions of computers with legitimate sales pitches or links to malicious Web sites, spam remains a major vehicle for spreading worms and malware, as well as for clogging Internet traffic. A staggering 180 billion spam messages are sent each day, representing about 90 percent of the world's e-mail traffic.
• Worms. The rise of social networking has made it easier to launch worm attacks. People engaging in these online communities are more likely to click links and download content they believe were sent by people they know and trust.
• Spamdexing. Many types of businesses use search engine optimization to be listed more prominently in searches conducted on Google and other sites. Spamdexing, which packs a Web site with relevant keywords or search terms, is increasingly being used by cybercriminals seeking to disguise malware as legitimate software. Because so many consumers tend to trust rankings on leading search engines, they may readily download one of the fake software packages.
• Text message scams. Since the start of 2009 at least two or three new campaigns have surfaced every week targeting handheld mobile devices. Cisco describes the rapidly growing mobile device audience as a "new frontier for fraud irresistible to criminals." With some 4.1 billion mobile phone subscriptions worldwide, a criminal may cast an extraordinarily wide net and still walk away with a nice profit, even if the attack yields only a small fraction of victims.
• Insiders. The global recession has caused many job losses. As a result, insider threats are an increasing concern for businesses in the months ahead. Insiders who commit fraud can be contractors or other third parties as well as current and former employees.

Supporting Quotes:

• Patrick Peterson, Cisco fellow and chief security researcher

"Securing the Internet has long been a moving target as criminals develop increasingly sophisticated ways to breach corporate networks and obtain valuable personal data. What is striking in our latest findings is how, in addition to using their technical skills to cast a wide net and avoid detection, these criminals are also demonstrating some strong business acumen. They are collaborating with each other, preying on individuals' greatest fears and interests, and increasingly making use of legitimate Internet tools like search engines and the software-as-a-service model. Some also continue to succeed using well-documented methods that in recent years have been downplayed as threats given the preponderance of new tactics. With criminals being so quick to identify weaknesses both in online networks and in consumers' psyches, businesses need to adopt ever more advanced ways to fight cybercrime and remain vigilant across all attack vectors."

Video

In video blogs posted today, Peterson describes some of the new threats to cybersecurity that gained prominence during the first half of 2009:

• Patrick Peterson, Cisco fellow and chief security researcher
• Video blog of the Cisco 2009 Midyear Security Report

Supporting Resources:

• Cisco 2009 Midyear Security Report
• 2008 Edition of the Cisco® Annual Security Report
• The Internet TV broadcast of the Cisco 2009 Midyear Security Report can be accessed at  http://tools.cisco.com/cmn/jsp/index.jsp?id=89479 on July 14 at 8 a.m. Pacific. Click "Play" to launch the live presentation. No registration required.
• Cisco Security Intelligence Operations - Cisco Security Intelligence Operations (SIO) is an advanced security infrastructure that enables the highest level of security and threat detection and prevention for Cisco customers. Cisco SIO relies on tightly integrated data derived from multiple Cisco divisions and devices to assess and correlate Internet threats and vulnerabilities. As threats continue to evolve, Cisco SIO enhances the ability to identify global threat activities and trends, and to provide expert analysis and services to help protect users. With a team of global research engineers, sophisticated security intelligence and automated update systems, Cisco SIO allows customers to embrace new technologies with a high degree of security so that they can collaborate with confidence.
• Visit the Cisco Security blog on The Platform

Technorati Tags:

 Cisco, firewall, web security, email security, IronPort, spam, virus, malware, enterprise security, security appliance.