Australia's encrypted cyber attacks rise despite security efforts
As Australia strives towards becoming the most cyber secure country by 2030, a new report has found that it ranks within the top five nations targeted by encrypted cyber attacks. This research, conducted by Zscaler, discovered that 86% of all threats, encompassing malware, ransomware and phishing attacks, are delivered over encrypted channels. Noticeably, the report also highlighted a drastic 290% rise in ad spyware site attacks in the APAC region.
Manufacturing was identified as the most targeted industry for the second successive year. Comparatively, education and government organisations manifested the greatest year-on-year escalations in attack incidences. A 24% year-on-year proliferation in threats over HTTPS was also recorded by the Zscaler cloud, representing approximately 30 billion blocked threats. Furthermore, encrypted malware and malicious content emerged as the principal threat, comprising 78% of observed attacks.
An increased susceptibility to browser exploits and ad spyware sites, made evident by a 297% and 290% year-on-year surge respectively, was noteworthy in the study. By processing over 2.1 billion AI/ML-related transactions, manufacturing bore the brunt of 32% of encrypted attacks, cementing its position yet again as the industry most prone to such onslaughts.
Deepen Desai, Chief Security Officer at Zscaler, emphasised the extent of cybercriminal exploitation currently underway in the context of encrypted channels. He addressed that with nearly 95% of web traffic flowing over HTTPS and 86% of the advanced threats propagated over encrypted channels, any HTTPS traffic that doesn't go through inline inspection produces considerable blind spots. He further advocated for a shift away from vulnerable appliances towards a Zero Trust Network Access (ZTNA) solution, allowing IT teams to inspect TLS traffic at scale, thereby blocking threats and preventing sensitive data spillage.
The use of artificial intelligence and machine learning (AI/ML) in manufacturing was flagged as a key concern by the report, due to its potential to expand the industry's attack surface. Furthermore, industries such as education and government were highlighted for their respective 276% and 185% year-on-year increase in encrypted attacks. The transition towards more remote and connected learning has proliferated the attack surface in educational institutions, while the government sector, traditionally an attractive target especially for nation-state-backed threat actors, continues to grapple with a swelling tide of encrypted threats.
Accordingly to Zscaler's report, substantive changes in the generic approaches towards security and networking are overdue. To successfully defend against the rapidly evolving encrypted threat landscape, enterprises should adopt comprehensive, zero trust architectures which can inspect all encrypted traffic and use AI/ML models to block or isolate malicious traffic, thereby minimising business risk at each stage of a cyber attack.
Finally, Zscaler suggests deploying various defences such as a cloud-native, proxy-based architecture that would decrypt, detect, and prevent threats in all encrypted traffic at scale. By inspecting all traffic continuously, utilising AI-driven sandboxing techniques to quarantine unknown attacks, evaluating an organisation's attack surface to quantify risk, and implementing a zero-trust architecture that secures all connectivity holistically, organisations can bolster their defences against encrypted attacks.
