sb-au logo
Story image

Carbon Black claims there's a link between geopolitics and cyberterrorism

25 Jul 2018

China, North Korea, and Russia are responsible of many of the world’s cyber attacks, and according to Carbon Black those countries are both operationalizing and supporting advanced cyber militias.

Those are some of the findings from the company’s Quarterly Incident Response Threat Report, which points the finger at the link between geopolitical tensions and increasing cyber warfare efforts.

“Geopolitical tensions manifest in cyberspace. There is a direct link between the failures of diplomacy and cyberespionage and cyberterrorism. The cold war adversaries have colonised wide swaths of Western cyberspace. This is compounded by the reality that organised crime syndicates have migrated their criminal conspiracies online,” says Carbon Black’s chief cybersecurity officer, Tom Kellermann.

According to the report, Russia is the origin point for most attacks, but China follows close behind. North America, Iran, North Korea, and Brazil also round out the top six.

Those intrusions are no longer reserved for select targets and they are a threat to all organizations, he continues.

According to the report, 31% of incident response professionals say that the reasons behind cyber attacks are not just financial gain or data theft, but also espionage.

Attackers are also moving laterally throughout systems – 59% of attacks use this tactic, which means they aren’t targeting one part of a system. Instead, they are moving around and seeing more targets as they go.

PowerShell is a popular tool of choice for attackers seeking lateral movement.

Attackers are also getting wise to organisations’ incident response strategies.

The report says that 46% of respondents say they’ve experienced instances of counter incident response.

“The cyber intrusions of today have evolved from burglary to home invasion. Today’s cyber intrusions are more persistent and more destructive.  In fact, the Cb Incident Response Threat Report noted that over 46% of cyber intrusions experiences counter-incident response e.g. The adversary was fighting back to remain in the system.  The same study noted that 10% have experienced destructive attacks,” Kellermann says.

Carbon Black also notes that because criminals can sniff out incident response strategies, those strategies must now evolve to become stealthier.

Finally, 36% of respondents say attackers now use victims for ‘island hopping’.

“In these campaigns, attackers first target an organization’s affiliates, often smaller companies with immature security postures. This means that not only is your data at risk, but so is the data at every point in the supply chain, including customers and partners,” Kellermann concludes.

The Quarterly Incident Response Threat Report quizzed 37 leading incident response organisations, all of which were Carbon Black partners.

Story image
Ransomware the most common cyber threat to SMBs - report
The survey found that 60% of managed service providers report that their SMB clients have been hit as of Q3 2020. More
Story image
DevSecOps increasingly important, but APAC organisations lagging behind
The rise of DevSecOps comes at a time when IT leaders are faced with an increasingly active cyber threat landscape, coupled with higher consumer expectations of digital offerings and application usage due to a sharp increase in online activities.More
Story image
Frost & Sullivan: Firewalls to drive network security market
Enterprises’ heightened threats from criminal entities and state-sponsored actors are strongly encouraging them to adopt network security solutions.More
Story image
Claroty and CrowdStrike form partnership to protect industrial control system environements
The integration will deliver visibility into industrial control system (ICS) networks and endpoints, with a one-stop-shop for information technology (IT) and OT asset information directly within The Claroty Platform.More
Story image
Forrester names Thycotic a Leader in privileged access management
Thycotic received the highest possible score in 11 of the 24 criteria in the study, including SaaS/cloud, innovation roadmap, and integrations, deployment, supporting products and services, commercial model, and PIM installed base.More
Story image
Why 2021 will be the year of catch-up
The transition to remote work and new online contactless business models is not temporary and is affecting the future strategy on how organisations invest in cybersecurity, writes Radware vice president and managing director for EMEA and LATAM, Rob Hartley.More